{"id":"CVE-2026-44950","aliases":["ALSA-2026:55446","ALSA-2026:55447","ALSA-2026:55448","AZL-101733","CLSA-2026-1787150510","CLSA-2026-1787162017","CLSA-2026-1790784764","CLSA-2026-1790786405","DEBIAN-CVE-2026-44950","EUVD-2026-75306","GHSA-72vv-3gwg-8289","MGASA-2026-0471","OESA-2026-3466","RHSA-2026:55446","RHSA-2026:55447","RHSA-2026:55448","RHSA-2026:59311","RHSA-2026:59312","RHSA-2026:61390","RHSA-2026:61755","RHSA-2026:61756","RHSA-2026:61995","RHSA-2026:62123","RHSA-2026:62231","RLSA-2026:55446","RLSA-2026:55447","RLSA-2026:55448","SUSE-SU-2026:23128-1","SUSE-SU-2026:23151-1","SUSE-SU-2026:3499-1","SUSE-SU-2026:3500-1","UBUNTU-CVE-2026-44950","openSUSE-SU-2026:11463-1","openSUSE-SU-2026:21539-1"],"status":"published","title":"fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow in libXfont2","description":"fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice (position, length) lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the allocation.\n\nA malicious font server can send overlapping source offsets -- for example 1000 glyphs each referencing {position:0, length:64} with nbytes=64. Each individual source range passes the existing validation, but the cumulative writes total 64000 bytes into a 64-byte destination buffer. This is a heap buffer overflow with attacker-controlled content.","severity":{"version":"4.0","score":9.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00262,"percentile":0.18143,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122"],"published":"2026-08-05T11:56:49Z","modified":"2026-10-29T11:32:24Z","fixes":[{"ecosystem":"Azure Linux:3","package":"libXfont2","fixed_in":["2.0.9-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libxfont","fixed_in":["1:2.0.9-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-2.el8_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libXfont2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-2.el8_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-12.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libXfont2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-12.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.6-5.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libXfont2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.6-5.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Azure Linux:3","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.9-1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-12.el9_2.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libXfont2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-12.el9_2.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-12.el9_6.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libXfont2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-12.el9_6.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-1.0.3.el7_9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"libXfont2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-1.0.3.el7_9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-1.0.3.el7_9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"libXfont2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-1.0.3.el7_9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"libxfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.0.6-1","1:2.0.6-1+deb12u1","1:2.0.6-1+hurd.1","1:2.0.6-2","1:2.0.8-1","1:2.0.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libxfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.0.6-1","1:2.0.6-1+deb13u1","1:2.0.6-1+hurd.1","1:2.0.6-2","1:2.0.8-1","1:2.0.9-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libxfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.9-1"}]}],"versions":["1:2.0.6-1","1:2.0.6-1+hurd.1","1:2.0.6-2","1:2.0.8-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"libxfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.9-1.mga10"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.5-6.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.6-4.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.6-4.oe2403sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.6-4.oe2403sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-3.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libXfont2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libXfont2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libXfont2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libXfont2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libXfont2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-12.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libXfont2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-12.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libXfont2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-12.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libXfont2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-12.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libXfont2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-12.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libXfont2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-12.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.6-5.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libXfont2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.6-5.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libXfont2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.6-5.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libXfont2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.6-5.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-12.el9_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"libXfont2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-12.el9_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"libXfont2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-12.el9_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-12.el9_4.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"libXfont2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-12.el9_4.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"libXfont2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-12.el9_4.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-12.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"libXfont2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-12.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"libXfont2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-12.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"libXfont2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-12.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"libXfont2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-12.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"libXfont2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-12.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"libXfont2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"libXfont2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"libXfont2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"libXfont2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"libXfont2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"libXfont2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"libXfont2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"libXfont2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"libXfont2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"libXfont2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"libXfont2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"libXfont2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.6-5.el10_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libXfont2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.6-5.el10_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libXfont2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.6-5.el10_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libXfont2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.6-5.el10_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"libXfont2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"libXfont2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-12.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.6-5.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-160000.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-160000.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-160000.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-160000.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-150000.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-150000.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-150000.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-150000.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-150000.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-150000.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-150000.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-150000.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-150000.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-150000.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-150000.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libxfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.0.1-3~ubuntu16.04.1","1:2.0.1-3~ubuntu16.04.2","1:2.0.1-3~ubuntu16.04.3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-160000.5.1"}]}],"bundled":2}],"products":[{"vendor":"libxfont","product":"libxfont"},{"vendor":"suse","product":"container suse/kiosk/tigervnc-x11vnc:1.14-63.8"},{"vendor":"suse","product":"container suse/kiosk/xorg:21.1-83.7"},{"vendor":"suse","product":"image sles-sap-azure"},{"vendor":"suse","product":"image sles-sap-azure-3p"},{"vendor":"suse","product":"image sles-sap-byos-azure"},{"vendor":"suse","product":"image sles-sap-byos-ec2"},{"vendor":"suse","product":"image sles-sap-byos-gce"},{"vendor":"suse","product":"image sles-sap-gce"},{"vendor":"suse","product":"image sles-sap-gce-3p"},{"vendor":"suse","product":"image sles-sapcal-gce"},{"vendor":"suse","product":"image sles12-sp5-azure-sap-byos"},{"vendor":"suse","product":"image sles12-sp5-azure-sap-on-demand"},{"vendor":"suse","product":"image sles12-sp5-ec2-sap-byos"},{"vendor":"suse","product":"image sles12-sp5-ec2-sap-on-demand"},{"vendor":"suse","product":"image sles12-sp5-gce-sap-byos"},{"vendor":"suse","product":"image sles12-sp5-gce-sap-on-demand"},{"vendor":"suse","product":"image sles15-sp6-sap"},{"vendor":"suse","product":"image sles15-sp6-sap-azure"},{"vendor":"suse","product":"image sles15-sp6-sap-azure-3p"},{"vendor":"suse","product":"image sles15-sp6-sap-byos"},{"vendor":"suse","product":"image sles15-sp6-sap-byos-azure"},{"vendor":"suse","product":"image sles15-sp6-sap-byos-ec2"},{"vendor":"suse","product":"image sles15-sp6-sap-byos-gce"},{"vendor":"suse","product":"image sles15-sp6-sap-ec2"},{"vendor":"suse","product":"image sles15-sp6-sap-gce"},{"vendor":"suse","product":"image sles15-sp6-sap-hardened"},{"vendor":"suse","product":"image sles15-sp6-sap-hardened-azure"},{"vendor":"suse","product":"image sles15-sp6-sap-hardened-byos"},{"vendor":"suse","product":"image sles15-sp6-sap-hardened-byos-azure"},{"vendor":"suse","product":"image sles15-sp6-sap-hardened-byos-ec2"},{"vendor":"suse","product":"image sles15-sp6-sap-hardened-byos-gce"},{"vendor":"suse","product":"image sles15-sp6-sap-hardened-ec2"},{"vendor":"suse","product":"image sles15-sp6-sap-hardened-gce"},{"vendor":"suse","product":"image sles15-sp6-sapcal"},{"vendor":"suse","product":"image sles15-sp6-sapcal-azure"},{"vendor":"suse","product":"image sles15-sp6-sapcal-ec2"},{"vendor":"suse","product":"image sles15-sp6-sapcal-gce"},{"vendor":"suse","product":"image sles15-sp7-sap-azure"},{"vendor":"suse","product":"image sles15-sp7-sap-azure-3p"},{"vendor":"suse","product":"image sles15-sp7-sap-byos-azure"},{"vendor":"suse","product":"image sles15-sp7-sap-byos-ec2"},{"vendor":"suse","product":"image sles15-sp7-sap-byos-gce"},{"vendor":"suse","product":"image sles15-sp7-sap-ec2"},{"vendor":"suse","product":"image sles15-sp7-sap-gce"},{"vendor":"suse","product":"image sles15-sp7-sap-gce-3p"},{"vendor":"suse","product":"image sles15-sp7-sap-hardened-azure"},{"vendor":"suse","product":"image sles15-sp7-sap-hardened-byos-azure"},{"vendor":"suse","product":"image sles15-sp7-sap-hardened-byos-ec2"},{"vendor":"suse","product":"image sles15-sp7-sap-hardened-byos-gce"},{"vendor":"suse","product":"image sles15-sp7-sap-hardened-gce"},{"vendor":"suse","product":"image sles15-sp7-sapcal-azure"},{"vendor":"suse","product":"image sles15-sp7-sapcal-ec2"},{"vendor":"suse","product":"image sles15-sp7-sapcal-gce"},{"vendor":"suse","product":"opensuse leap 16.0"},{"vendor":"suse","product":"opensuse tumbleweed"},{"vendor":"suse","product":"suse liberty linux 10"},{"vendor":"suse","product":"suse liberty linux 8"},{"vendor":"suse","product":"suse liberty linux 9"},{"vendor":"suse","product":"suse linux enterprise desktop 15 sp7"},{"vendor":"suse","product":"suse linux enterprise high performance computing 15 sp4-espos"},{"vendor":"suse","product":"suse linux enterprise high performance computing 15 sp4-ltss"},{"vendor":"suse","product":"suse linux enterprise high performance computing 15 sp5-espos"},{"vendor":"suse","product":"suse linux enterprise high performance computing 15 sp5-ltss"},{"vendor":"suse","product":"suse linux enterprise module for basesystem 15 sp7"},{"vendor":"suse","product":"suse linux enterprise server 12 sp5-ltss"},{"vendor":"suse","product":"suse linux enterprise server 15 sp4-ltss"},{"vendor":"suse","product":"suse linux enterprise server 15 sp5-ltss"},{"vendor":"suse","product":"suse linux enterprise server 15 sp6-ltss"},{"vendor":"suse","product":"suse linux enterprise server 15 sp7"},{"vendor":"suse","product":"suse linux enterprise server 16.0"},{"vendor":"suse","product":"suse linux enterprise server for sap applications 15 sp4"},{"vendor":"suse","product":"suse linux enterprise server for sap applications 15 sp5"},{"vendor":"suse","product":"suse linux enterprise server for sap applications 15 sp6"},{"vendor":"suse","product":"suse linux enterprise server for sap applications 15 sp7"},{"vendor":"suse","product":"suse linux enterprise server for sap applications 16.0"},{"vendor":"suse","product":"suse linux enterprise server ltss extended security 12 sp5"},{"vendor":"suse","product":"suse manager proxy lts 4.3"},{"vendor":"suse","product":"suse manager retail branch server lts 4.3"},{"vendor":"suse","product":"suse manager server lts 4.3"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44950"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44950","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-72vv-3gwg-8289"},{"url":"https://access.redhat.com/errata/RHSA-2026:55446","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44950","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59679","tags":["report"]},{"url":"https://bugzilla.redhat.com/2509620","tags":["report"]},{"url":"https://bugzilla.redhat.com/2509622","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-55446.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:55447","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-55447.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:55448","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-55448.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1787150510.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59679","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1787162017.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1790784764.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1790786405.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-44950","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0471.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36174","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NP3ZEUVKBUAKXYPBOSJNJAGWTMNRTSSG/","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/PTGMTNHE2PKU34GA4TVT54ZYUWSQDO6P/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3466","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509620","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509622","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55446.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44950","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59679","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55447.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55448.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:59311","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59311.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:59312","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59312.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61390","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61390.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61755","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61755.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61756","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61756.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61995","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61995.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:62123","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_62123.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:62231","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_62231.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:55446","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:55447","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:55448","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623128-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1272660","tags":["report"]},{"url":"https://bugzilla.suse.com/1272661","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59679","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623151-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263499-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263500-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-44950","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/08/05/1","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-44950","title":"fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow in libXfont2","description":"fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice (position, length) lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the allocation.\n\nA malicious font server can send overlapping source offsets -- for example 1000 glyphs each referencing {position:0, length:64} with nbytes=64. Each individual source range passes the existing validation, but the cumulative writes total 64000 bytes into a 64-byte destination buffer. This is a heap buffer overflow with attacker-controlled content.","status":"published","published":"2026-09-10T08:19:55.462Z","modified":"2026-09-10T18:26:50.408Z","cvss":[{"version":"4.0","score":9.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna"},{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T13:42:49.132798Z"}],"euvd":[{"id":"EUVD-2026-75306","description":"fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice (position, length) lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the allocation.\n\nA malicious font server can send overlapping source offsets -- for example 1000 glyphs each referencing {position:0, length:64} with nbytes=64. Each individual source range passes the existing validation, but the cumulative writes total 64000 bytes into a 64-byte destination buffer. This is a heap buffer overflow with attacker-controlled content.","status":"published","published":"2026-09-10T08:19:55Z","modified":"2026-09-10T18:26:50Z","cvss":[{"version":"4.0","score":9.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"updated_at":"2026-11-02T17:28:23.831795Z"}],"ghsa":[{"id":"GHSA-72vv-3gwg-8289","title":"fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap...","description":"fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice (position, length) lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the allocation.\n\nA malicious font server can send overlapping source offsets -- for example 1000 glyphs each referencing {position:0, length:64} with nbytes=64. Each individual source range passes the existing validation, but the cumulative writes total 64000 bytes into a 64-byte destination buffer. This is a heap buffer overflow with attacker-controlled content.","status":"published","published":"2026-09-10T09:31:34Z","modified":"2026-09-10T21:32:31Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:11:43.788148Z"}],"nvd":[{"id":"CVE-2026-44950","description":"fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice (position, length) lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the allocation.\n\nA malicious font server can send overlapping source offsets -- for example 1000 glyphs each referencing {position:0, length:64} with nbytes=64. Each individual source range passes the existing validation, but the cumulative writes total 64000 bytes into a 64-byte destination buffer. This is a heap buffer overflow with attacker-controlled content.","status":"published","published":"2026-09-10T09:17:02.49Z","modified":"2026-09-10T19:17:27.73Z","cvss":[{"version":"4.0","score":9.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:12:45.93749Z"}],"osv":[{"id":"DEBIAN-CVE-2026-44950","description":"fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice (position, length) lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the allocation.  A malicious font server can send overlapping source offsets -- for example 1000 glyphs each referencing {position:0, length:64} with nbytes=64. Each individual source range passes the existing validation, but the cumulative writes total 64000 bytes into a 64-byte destination buffer. This is a heap buffer overflow with attacker-controlled content.","status":"published","published":"2026-09-10T09:17:02.49Z","modified":"2026-10-01T03:03:06.097394879Z","cvss":[{"version":"4.0","score":9.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"}],"updated_at":"2026-11-02T15:45:55.669088Z"},{"id":"OESA-2026-3466","title":"libXfont2 security update","description":"libXfont provides the core of the legacy X11 font system, handling the index files (fonts.dir, fonts.alias, fonts.scale), the various font file formats, and rasterizing them.  contains runtime  library.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in the libXfont2 font-server client. This heap buffer overflow vulnerability allows a malicious font server to send specially crafted glyph data. The fs_read_glyphs() function fails to properly validate the total size of the incoming data, leading to an overwrite of memory beyond the intended buffer. If the X server runs as a privileged user, this could result in privilege escalation, allowing an attacker to gain higher access. If the X server runs as an unprivileged user, it could lead to a denial of service, causing the system to crash.(CVE-2026-44950)\n\nA flaw was found in the libXfont2 font-server client. A remote attacker, by operating a malicious font server, could exploit an out-of-bounds read/write vulnerability. This occurs because the client incorrectly handles font data, leading to an out-of-bounds memory access. This can lead to privilege escalation if the X server runs with root privileges, or a denial of service (crash) if it runs as an unprivileged user.(CVE-2026-59679)","status":"published","published":"2026-08-20T10:00:34Z","modified":"2026-08-20T10:15:13.353247293Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"RHSA-2026:55446","title":"Red Hat Security Advisory: libXfont2 security update","status":"published","published":"2026-08-18T10:20:59Z","modified":"2026-10-07T10:14:32Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:55447","title":"Red Hat Security Advisory: libXfont2 security update","status":"published","published":"2026-08-17T10:17:00Z","modified":"2026-10-07T10:14:33Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:55448","title":"Red Hat Security Advisory: libXfont2 security update","status":"published","published":"2026-08-17T10:17:01Z","modified":"2026-10-07T10:14:33Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:59311","title":"Red Hat Security Advisory: libXfont2 security update","status":"published","published":"2026-08-25T10:23:25Z","modified":"2026-10-07T10:15:21Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:59312","title":"Red Hat Security Advisory: libXfont2 security update","status":"published","published":"2026-08-25T10:23:26Z","modified":"2026-10-07T10:15:22Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:61390","title":"Red Hat Security Advisory: libXfont2 security update","status":"published","published":"2026-09-01T10:28:27Z","modified":"2026-10-07T10:15:47Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:61755","title":"Red Hat Security Advisory: libXfont2 security update","status":"published","published":"2026-09-01T10:28:37Z","modified":"2026-10-07T10:15:49Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:61756","title":"Red Hat Security Advisory: libXfont2 security update","status":"published","published":"2026-09-01T10:28:37Z","modified":"2026-10-07T10:15:50Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:61995","title":"Red Hat Security Advisory: libXfont2 security update","status":"published","published":"2026-09-02T10:22:17Z","modified":"2026-10-07T10:15:55Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:62123","title":"Red Hat Security Advisory: libXfont2 security update","status":"published","published":"2026-09-02T10:22:19Z","modified":"2026-10-07T10:15:57Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:62231","title":"Red Hat Security Advisory: libXfont2 security update","status":"published","published":"2026-09-02T10:22:25Z","modified":"2026-10-07T10:15:57Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RLSA-2026:55446","title":"Important: libXfont2 security update","description":"X.Org X11 libXfont2 runtime library\n\nSecurity Fix(es):\n\n* libxfont2: Font Server Client encoding[] Out-Of-Bounds Read/Write (CVE-2026-59679)\n\n* libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client (CVE-2026-44950)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-17T18:01:12.967623Z","modified":"2026-08-17T18:30:03.363273853Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:55447","title":"Important: libXfont2 security update","description":"X.Org X11 libXfont2 runtime library\n\nSecurity Fix(es):\n\n* libxfont2: Font Server Client encoding[] Out-Of-Bounds Read/Write (CVE-2026-59679)\n\n* libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client (CVE-2026-44950)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-17T18:03:57.407277Z","modified":"2026-08-17T18:30:03.372395026Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:55448","title":"Important: libXfont2 security update","description":"X.Org X11 libXfont2 runtime library\n\nSecurity Fix(es):\n\n* libxfont2: Font Server Client encoding[] Out-Of-Bounds Read/Write (CVE-2026-59679)\n\n* libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client (CVE-2026-44950)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-17T18:06:54.076078Z","modified":"2026-08-17T18:30:03.408459317Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"UBUNTU-CVE-2026-44950","description":"fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice (position, length) lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the allocation. A malicious font server can send overlapping source offsets -- for example 1000 glyphs each referencing {position:0, length:64} with nbytes=64. Each individual source range passes the existing validation, but the cumulative writes total 64000 bytes into a 64-byte destination buffer. This is a heap buffer overflow with attacker-controlled content.","status":"published","published":"2026-09-10T09:17:00Z","modified":"2026-09-28T17:30:04.858463928Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"updated_at":"2026-11-02T16:56:26.396868Z"},{"id":"ALSA-2026:55446","title":"Important: libXfont2 security update","description":"X.Org X11 libXfont2 runtime library  \n\nSecurity Fix(es):  \n\n  * libxfont2: Font Server Client encoding[] Out-Of-Bounds Read/Write (CVE-2026-59679)\n  * libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client (CVE-2026-44950)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-17T00:00:00Z","modified":"2026-10-29T11:02:29.03506943Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:55447","title":"Important: libXfont2 security update","description":"X.Org X11 libXfont2 runtime library  \n\nSecurity Fix(es):  \n\n  * libxfont2: Font Server Client encoding[] Out-Of-Bounds Read/Write (CVE-2026-59679)\n  * libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client (CVE-2026-44950)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-17T00:00:00Z","modified":"2026-10-29T11:32:24.102301977Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:55448","title":"Important: libXfont2 security update","description":"X.Org X11 libXfont2 runtime library  \n\nSecurity Fix(es):  \n\n  * libxfont2: Font Server Client encoding[] Out-Of-Bounds Read/Write (CVE-2026-59679)\n  * libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client (CVE-2026-44950)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-17T00:00:00Z","modified":"2026-10-29T11:30:38.459667519Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"AZL-101733","title":"CVE-2026-44950 affecting package libXfont2 for versions less than 2.0.9-1","description":"fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice (position, length) lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the allocation.\n\nA malicious font server can send overlapping source offsets -- for example 1000 glyphs each referencing {position:0, length:64} with nbytes=64. Each individual source range passes the existing validation, but the cumulative writes total 64000 bytes into a 64-byte destination buffer. This is a heap buffer overflow with attacker-controlled content.","status":"published","published":"2026-09-10T09:17:02Z","modified":"2026-09-23T14:15:56.097237505Z","updated_at":"2026-11-02T15:28:00.508704Z"},{"id":"CLSA-2026-1787150510","title":"libXfont2: Fix of 2 CVEs","description":"- Fix CVE-2026-59679: out-of-bounds read/write in fs_read_glyphs due to\n  num_chars not being validated against the allocated encoding array size\n  in fserve.c\n  (upstream commit 668fea81f40bcb48ec67fb55d0b851049d265290)\n- Fix CVE-2026-44950: heap buffer overflow in fs_read_glyphs due to a missing\n  bounds check on cumulative glyph data writes into the allbits buffer\n  in fserve.c\n  (upstream commit c2d222bb22c623d8a40f3275077fc7e6617f2c8a)","status":"published","published":"2026-08-19T14:42:02Z","modified":"2026-10-26T09:43:25.560267596Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787162017","title":"libXfont2: Fix of 2 CVEs","description":"- CVE-2026-59679: validate num_chars against the encoding array size in\n  fs_read_glyphs() in src/fc/fserve.c; prevents an out-of-bounds read/write on\n  encoding[] when a font server sends more glyphs than extents\n  (upstream commit 668fea81f40bcb48ec67fb55d0b851049d265290)\n- CVE-2026-44950: bounds-check cumulative glyph data writes in fs_read_glyphs()\n  in src/fc/fserve.c; prevents a heap buffer overflow from overlapping source\n  offsets whose total length exceeds the allocated bitmap buffer\n  (upstream commit c2d222bb22c623d8a40f3275077fc7e6617f2c8a)","status":"published","published":"2026-08-26T09:32:20Z","modified":"2026-10-26T09:43:54.830306542Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1790784764","title":"libXfont2: Fix of 2 CVEs","description":"- rebase to 2.0.3-1.0.3.el7\n- the vendor fixes in this build: CVE-2026-44950, CVE-2026-59679\n- drop the 3 TuxCare CVE backports; the vendor now ships their own patches for them\n- no TuxCare CVE patches remain","status":"published","published":"2026-09-30T16:12:54Z","modified":"2026-10-26T09:31:56.818648033Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790786405","title":"libXfont2: Fix of 2 CVEs","description":"- rebase to 2.0.3-1.0.3.el7\n- the vendor fixes in this build: CVE-2026-44950, CVE-2026-59679\n- drop the 3 TuxCare CVE backports; the vendor now ships their own patches for them\n- no TuxCare CVE patches remain","status":"published","published":"2026-09-30T16:40:14Z","modified":"2026-10-26T09:31:49.525610537Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"MGASA-2026-0471","title":"Updated libxfont2 package fixes security vulnerabilities","description":"fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow\nin libXfont2. (CVE-2026-44950)\nfs_read_glyphs() heap OOB read/write via encoding array index mismatch\nin libXfont2. (CVE-2026-59679)\n","status":"published","published":"2026-10-08T16:23:08Z","modified":"2026-10-08T16:42:40.44927664Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11463-1","title":"libXfont2-2-2.0.7-3.1 on GA media","description":"These are all security issues fixed in the libXfont2-2-2.0.7-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-06T00:00:00Z","modified":"2026-08-07T10:00:44.919525471Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21539-1","title":"Security update for libXfont2","description":"This update for libXfont2 fixes the following issues:\n\n- CVE-2026-44950: fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow (bsc#1272661).\n- CVE-2026-59679: fs_read_glyphs() heap OOB read/write via encoding array index mismatch (bsc#1272660).\n","status":"published","published":"2026-08-06T09:10:31Z","modified":"2026-08-08T18:23:58.446551776Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:23128-1","title":"Security update for libXfont2","description":"This update for libXfont2 fixes the following issues:\n\n- CVE-2026-44950: fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow (bsc#1272661).\n- CVE-2026-59679: fs_read_glyphs() heap OOB read/write via encoding array index mismatch (bsc#1272660).\n","status":"published","published":"2026-08-06T09:11:09Z","modified":"2026-08-14T18:23:45.272978641Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23151-1","title":"Security update for libXfont2","description":"This update for libXfont2 fixes the following issues:\n\n- CVE-2026-44950: fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow (bsc#1272661).\n- CVE-2026-59679: fs_read_glyphs() heap OOB read/write via encoding array index mismatch (bsc#1272660).\n","status":"published","published":"2026-08-06T09:11:09Z","modified":"2026-08-14T18:23:46.278969983Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:3499-1","title":"Security update for libXfont2","description":"This update for libXfont2 fixes the following issues:\n\n- CVE-2026-44950: fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow (bsc#1272661).\n- CVE-2026-59679: fs_read_glyphs() heap OOB read/write via encoding array index mismatch (bsc#1272660).\n","status":"published","published":"2026-08-05T11:56:49Z","modified":"2026-08-06T11:15:07.869728693Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3500-1","title":"Security update for libXfont2","description":"This update for libXfont2 fixes the following issues:\n\n- CVE-2026-44950: fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow (bsc#1272661).\n- CVE-2026-59679: fs_read_glyphs() heap OOB read/write via encoding array index mismatch (bsc#1272660).\n","status":"published","published":"2026-08-05T11:57:55Z","modified":"2026-08-06T11:15:06.526083568Z","updated_at":"2026-11-02T15:54:04.987808Z"}]}}