{"id":"CVE-2026-59679","aliases":["ALSA-2026:55446","ALSA-2026:55447","ALSA-2026:55448","AZL-101730","CLSA-2026-1787150510","CLSA-2026-1787162017","CLSA-2026-1790784764","CLSA-2026-1790786405","DEBIAN-CVE-2026-59679","EUVD-2026-75300","GHSA-g44m-wpf7-gr7x","MGASA-2026-0471","OESA-2026-3466","RHSA-2026:55446","RHSA-2026:55447","RHSA-2026:55448","RHSA-2026:59311","RHSA-2026:59312","RHSA-2026:61390","RHSA-2026:61755","RHSA-2026:61756","RHSA-2026:61995","RHSA-2026:62123","RHSA-2026:62231","RLSA-2026:55446","RLSA-2026:55447","RLSA-2026:55448","SUSE-SU-2026:23128-1","SUSE-SU-2026:23151-1","SUSE-SU-2026:3499-1","SUSE-SU-2026:3500-1","UBUNTU-CVE-2026-59679","openSUSE-SU-2026:11463-1","openSUSE-SU-2026:21539-1"],"status":"published","title":"fs_read_glyphs() heap OOB read/write via encoding array index mismatch in libXfont2","description":"fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a size derived from num_extents in the separate FS_QueryXExtents16 reply. The two CARD32 fields are never cross-checked.\nA malicious or compromised font server can send a small num_extents (e.g. 1) in the extents reply, then a large num_chars (e.g. 100000) in the bitmaps reply. This causes attacker-controlled out-of-bounds heap read and writes.","severity":{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00256,"percentile":0.174,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2026-08-05T11:56:49Z","modified":"2026-10-29T11:32:24Z","fixes":[{"ecosystem":"Azure Linux:3","package":"libXfont2","fixed_in":["2.0.9-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libxfont","fixed_in":["1:2.0.9-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-2.el8_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libXfont2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-2.el8_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-12.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libXfont2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-12.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.6-5.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libXfont2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.6-5.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Azure Linux:3","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.9-1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-12.el9_2.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libXfont2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-12.el9_2.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-12.el9_6.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libXfont2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-12.el9_6.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-1.0.3.el7_9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"libXfont2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-1.0.3.el7_9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-1.0.3.el7_9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"libXfont2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-1.0.3.el7_9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"libxfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.0.6-1","1:2.0.6-1+deb12u1","1:2.0.6-1+hurd.1","1:2.0.6-2","1:2.0.8-1","1:2.0.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libxfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.0.6-1","1:2.0.6-1+deb13u1","1:2.0.6-1+hurd.1","1:2.0.6-2","1:2.0.8-1","1:2.0.9-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libxfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.9-1"}]}],"versions":["1:2.0.6-1","1:2.0.6-1+hurd.1","1:2.0.6-2","1:2.0.8-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"libxfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.9-1.mga10"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.5-6.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.6-4.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.6-4.oe2403sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.6-4.oe2403sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-3.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libXfont2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libXfont2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libXfont2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libXfont2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libXfont2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-12.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libXfont2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-12.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libXfont2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-12.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libXfont2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-12.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libXfont2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-12.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libXfont2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-12.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.6-5.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libXfont2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.6-5.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libXfont2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.6-5.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libXfont2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.6-5.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-12.el9_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"libXfont2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-12.el9_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"libXfont2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-12.el9_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-12.el9_4.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"libXfont2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-12.el9_4.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"libXfont2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-12.el9_4.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-12.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"libXfont2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-12.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"libXfont2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-12.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"libXfont2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-12.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"libXfont2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-12.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"libXfont2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-12.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"libXfont2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"libXfont2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"libXfont2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"libXfont2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"libXfont2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"libXfont2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"libXfont2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"libXfont2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"libXfont2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"libXfont2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"libXfont2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"libXfont2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.6-5.el10_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libXfont2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.6-5.el10_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libXfont2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.6-5.el10_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libXfont2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.6-5.el10_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"libXfont2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"libXfont2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el8_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-12.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.6-5.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-160000.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-160000.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-160000.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-160000.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-150000.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-150000.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-150000.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-150000.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-150000.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-150000.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-150000.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-150000.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-150000.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-150000.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-150000.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libxfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.0.1-3~ubuntu16.04.1","1:2.0.1-3~ubuntu16.04.2","1:2.0.1-3~ubuntu16.04.3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libXfont2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-160000.5.1"}]}],"bundled":2}],"products":[{"vendor":"libxfont2","product":"libxfont2"},{"vendor":"suse","product":"container suse/kiosk/tigervnc-x11vnc:1.14-63.8"},{"vendor":"suse","product":"container suse/kiosk/xorg:21.1-83.7"},{"vendor":"suse","product":"image sles-sap-azure"},{"vendor":"suse","product":"image sles-sap-azure-3p"},{"vendor":"suse","product":"image sles-sap-byos-azure"},{"vendor":"suse","product":"image sles-sap-byos-ec2"},{"vendor":"suse","product":"image sles-sap-byos-gce"},{"vendor":"suse","product":"image sles-sap-gce"},{"vendor":"suse","product":"image sles-sap-gce-3p"},{"vendor":"suse","product":"image sles-sapcal-gce"},{"vendor":"suse","product":"image sles12-sp5-azure-sap-byos"},{"vendor":"suse","product":"image sles12-sp5-azure-sap-on-demand"},{"vendor":"suse","product":"image sles12-sp5-ec2-sap-byos"},{"vendor":"suse","product":"image sles12-sp5-ec2-sap-on-demand"},{"vendor":"suse","product":"image sles12-sp5-gce-sap-byos"},{"vendor":"suse","product":"image sles12-sp5-gce-sap-on-demand"},{"vendor":"suse","product":"image sles15-sp6-sap"},{"vendor":"suse","product":"image sles15-sp6-sap-azure"},{"vendor":"suse","product":"image sles15-sp6-sap-azure-3p"},{"vendor":"suse","product":"image sles15-sp6-sap-byos"},{"vendor":"suse","product":"image sles15-sp6-sap-byos-azure"},{"vendor":"suse","product":"image sles15-sp6-sap-byos-ec2"},{"vendor":"suse","product":"image sles15-sp6-sap-byos-gce"},{"vendor":"suse","product":"image sles15-sp6-sap-ec2"},{"vendor":"suse","product":"image sles15-sp6-sap-gce"},{"vendor":"suse","product":"image sles15-sp6-sap-hardened"},{"vendor":"suse","product":"image sles15-sp6-sap-hardened-azure"},{"vendor":"suse","product":"image sles15-sp6-sap-hardened-byos"},{"vendor":"suse","product":"image sles15-sp6-sap-hardened-byos-azure"},{"vendor":"suse","product":"image sles15-sp6-sap-hardened-byos-ec2"},{"vendor":"suse","product":"image sles15-sp6-sap-hardened-byos-gce"},{"vendor":"suse","product":"image sles15-sp6-sap-hardened-ec2"},{"vendor":"suse","product":"image sles15-sp6-sap-hardened-gce"},{"vendor":"suse","product":"image sles15-sp6-sapcal"},{"vendor":"suse","product":"image sles15-sp6-sapcal-azure"},{"vendor":"suse","product":"image sles15-sp6-sapcal-ec2"},{"vendor":"suse","product":"image sles15-sp6-sapcal-gce"},{"vendor":"suse","product":"image sles15-sp7-sap-azure"},{"vendor":"suse","product":"image sles15-sp7-sap-azure-3p"},{"vendor":"suse","product":"image sles15-sp7-sap-byos-azure"},{"vendor":"suse","product":"image sles15-sp7-sap-byos-ec2"},{"vendor":"suse","product":"image sles15-sp7-sap-byos-gce"},{"vendor":"suse","product":"image sles15-sp7-sap-ec2"},{"vendor":"suse","product":"image sles15-sp7-sap-gce"},{"vendor":"suse","product":"image sles15-sp7-sap-gce-3p"},{"vendor":"suse","product":"image sles15-sp7-sap-hardened-azure"},{"vendor":"suse","product":"image sles15-sp7-sap-hardened-byos-azure"},{"vendor":"suse","product":"image sles15-sp7-sap-hardened-byos-ec2"},{"vendor":"suse","product":"image sles15-sp7-sap-hardened-byos-gce"},{"vendor":"suse","product":"image sles15-sp7-sap-hardened-gce"},{"vendor":"suse","product":"image sles15-sp7-sapcal-azure"},{"vendor":"suse","product":"image sles15-sp7-sapcal-ec2"},{"vendor":"suse","product":"image sles15-sp7-sapcal-gce"},{"vendor":"suse","product":"opensuse leap 16.0"},{"vendor":"suse","product":"opensuse tumbleweed"},{"vendor":"suse","product":"suse liberty linux 10"},{"vendor":"suse","product":"suse liberty linux 8"},{"vendor":"suse","product":"suse liberty linux 9"},{"vendor":"suse","product":"suse linux enterprise desktop 15 sp7"},{"vendor":"suse","product":"suse linux enterprise high performance computing 15 sp4-espos"},{"vendor":"suse","product":"suse linux enterprise high performance computing 15 sp4-ltss"},{"vendor":"suse","product":"suse linux enterprise high performance computing 15 sp5-espos"},{"vendor":"suse","product":"suse linux enterprise high performance computing 15 sp5-ltss"},{"vendor":"suse","product":"suse linux enterprise module for basesystem 15 sp7"},{"vendor":"suse","product":"suse linux enterprise server 12 sp5-ltss"},{"vendor":"suse","product":"suse linux enterprise server 15 sp4-ltss"},{"vendor":"suse","product":"suse linux enterprise server 15 sp5-ltss"},{"vendor":"suse","product":"suse linux enterprise server 15 sp6-ltss"},{"vendor":"suse","product":"suse linux enterprise server 15 sp7"},{"vendor":"suse","product":"suse linux enterprise server 16.0"},{"vendor":"suse","product":"suse linux enterprise server for sap applications 15 sp4"},{"vendor":"suse","product":"suse linux enterprise server for sap applications 15 sp5"},{"vendor":"suse","product":"suse linux enterprise server for sap applications 15 sp6"},{"vendor":"suse","product":"suse linux enterprise server for sap applications 15 sp7"},{"vendor":"suse","product":"suse linux enterprise server for sap applications 16.0"},{"vendor":"suse","product":"suse linux enterprise server ltss extended security 12 sp5"},{"vendor":"suse","product":"suse manager proxy lts 4.3"},{"vendor":"suse","product":"suse manager retail branch server lts 4.3"},{"vendor":"suse","product":"suse manager server lts 4.3"},{"vendor":"x.org","product":"libxfont2"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-59679"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59679","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-g44m-wpf7-gr7x"},{"url":"https://access.redhat.com/errata/RHSA-2026:55446","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44950","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59679","tags":["report"]},{"url":"https://bugzilla.redhat.com/2509620","tags":["report"]},{"url":"https://bugzilla.redhat.com/2509622","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-55446.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:55447","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-55447.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:55448","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-55448.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1787150510.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44950","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1787162017.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1790784764.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1790786405.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-59679","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0471.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36174","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NP3ZEUVKBUAKXYPBOSJNJAGWTMNRTSSG/","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/PTGMTNHE2PKU34GA4TVT54ZYUWSQDO6P/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3466","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509620","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509622","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55446.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44950","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59679","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55447.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55448.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:59311","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59311.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:59312","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59312.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61390","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61390.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61755","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61755.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61756","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61756.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61995","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61995.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:62123","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_62123.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:62231","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_62231.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:55446","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:55447","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:55448","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623128-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1272660","tags":["report"]},{"url":"https://bugzilla.suse.com/1272661","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59679","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623151-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263499-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263500-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-59679","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/08/05/1","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-59679","title":"fs_read_glyphs() heap OOB read/write via encoding array index mismatch in libXfont2","description":"fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a size derived from num_extents in the separate FS_QueryXExtents16 reply. The two CARD32 fields are never cross-checked.\nA malicious or compromised font server can send a small num_extents (e.g. 1) in the extents reply, then a large num_chars (e.g. 100000) in the bitmaps reply. This causes attacker-controlled out-of-bounds heap read and writes.","status":"published","published":"2026-09-10T08:15:24.892Z","modified":"2026-09-10T12:45:33.969Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna"},{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:19:58.560602Z"}],"euvd":[{"id":"EUVD-2026-75300","description":"fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a size derived from num_extents in the separate FS_QueryXExtents16 reply. The two CARD32 fields are never cross-checked.\nA malicious or compromised font server can send a small num_extents (e.g. 1) in the extents reply, then a large num_chars (e.g. 100000) in the bitmaps reply. This causes attacker-controlled out-of-bounds heap read and writes.","status":"published","published":"2026-09-10T08:15:24Z","modified":"2026-09-10T12:45:33Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T17:28:25.275283Z"}],"ghsa":[{"id":"GHSA-g44m-wpf7-gr7x","title":"fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character...","description":"fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a size derived from num_extents in the separate FS_QueryXExtents16 reply. The two CARD32 fields are never cross-checked.\nA malicious or compromised font server can send a small num_extents (e.g. 1) in the extents reply, then a large num_chars (e.g. 100000) in the bitmaps reply. This causes attacker-controlled out-of-bounds heap read and writes.","status":"published","published":"2026-09-10T09:31:34Z","modified":"2026-09-10T15:34:19Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"},{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:11:42.667371Z"}],"nvd":[{"id":"CVE-2026-59679","description":"fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a size derived from num_extents in the separate FS_QueryXExtents16 reply. The two CARD32 fields are never cross-checked.\nA malicious or compromised font server can send a small num_extents (e.g. 1) in the extents reply, then a large num_chars (e.g. 100000) in the bitmaps reply. This causes attacker-controlled out-of-bounds heap read and writes.","status":"published","published":"2026-09-10T09:17:02.883Z","modified":"2026-09-10T15:43:03.76Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:12:45.93749Z"}],"osv":[{"id":"DEBIAN-CVE-2026-59679","description":"fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a size derived from num_extents in the separate FS_QueryXExtents16 reply. The two CARD32 fields are never cross-checked. A malicious or compromised font server can send a small num_extents (e.g. 1) in the extents reply, then a large num_chars (e.g. 100000) in the bitmaps reply. This causes attacker-controlled out-of-bounds heap read and writes.","status":"published","published":"2026-09-10T09:17:02.883Z","modified":"2026-10-01T03:03:28.367205841Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"}],"updated_at":"2026-11-02T15:45:57.932517Z"},{"id":"OESA-2026-3466","title":"libXfont2 security update","description":"libXfont provides the core of the legacy X11 font system, handling the index files (fonts.dir, fonts.alias, fonts.scale), the various font file formats, and rasterizing them.  contains runtime  library.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in the libXfont2 font-server client. This heap buffer overflow vulnerability allows a malicious font server to send specially crafted glyph data. The fs_read_glyphs() function fails to properly validate the total size of the incoming data, leading to an overwrite of memory beyond the intended buffer. If the X server runs as a privileged user, this could result in privilege escalation, allowing an attacker to gain higher access. If the X server runs as an unprivileged user, it could lead to a denial of service, causing the system to crash.(CVE-2026-44950)\n\nA flaw was found in the libXfont2 font-server client. A remote attacker, by operating a malicious font server, could exploit an out-of-bounds read/write vulnerability. This occurs because the client incorrectly handles font data, leading to an out-of-bounds memory access. This can lead to privilege escalation if the X server runs with root privileges, or a denial of service (crash) if it runs as an unprivileged user.(CVE-2026-59679)","status":"published","published":"2026-08-20T10:00:34Z","modified":"2026-08-20T10:15:13.353247293Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"RHSA-2026:55446","title":"Red Hat Security Advisory: libXfont2 security update","status":"published","published":"2026-08-18T10:20:59Z","modified":"2026-10-07T10:14:32Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:55447","title":"Red Hat Security Advisory: libXfont2 security update","status":"published","published":"2026-08-17T10:17:00Z","modified":"2026-10-07T10:14:33Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:55448","title":"Red Hat Security Advisory: libXfont2 security update","status":"published","published":"2026-08-17T10:17:01Z","modified":"2026-10-07T10:14:33Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:59311","title":"Red Hat Security Advisory: libXfont2 security update","status":"published","published":"2026-08-25T10:23:25Z","modified":"2026-10-07T10:15:21Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:59312","title":"Red Hat Security Advisory: libXfont2 security update","status":"published","published":"2026-08-25T10:23:26Z","modified":"2026-10-07T10:15:22Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:61390","title":"Red Hat Security Advisory: libXfont2 security update","status":"published","published":"2026-09-01T10:28:27Z","modified":"2026-10-07T10:15:47Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:61755","title":"Red Hat Security Advisory: libXfont2 security update","status":"published","published":"2026-09-01T10:28:37Z","modified":"2026-10-07T10:15:49Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:61756","title":"Red Hat Security Advisory: libXfont2 security update","status":"published","published":"2026-09-01T10:28:37Z","modified":"2026-10-07T10:15:50Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:61995","title":"Red Hat Security Advisory: libXfont2 security update","status":"published","published":"2026-09-02T10:22:17Z","modified":"2026-10-07T10:15:55Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:62123","title":"Red Hat Security Advisory: libXfont2 security update","status":"published","published":"2026-09-02T10:22:19Z","modified":"2026-10-07T10:15:57Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:62231","title":"Red Hat Security Advisory: libXfont2 security update","status":"published","published":"2026-09-02T10:22:25Z","modified":"2026-10-07T10:15:57Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RLSA-2026:55446","title":"Important: libXfont2 security update","description":"X.Org X11 libXfont2 runtime library\n\nSecurity Fix(es):\n\n* libxfont2: Font Server Client encoding[] Out-Of-Bounds Read/Write (CVE-2026-59679)\n\n* libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client (CVE-2026-44950)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-17T18:01:12.967623Z","modified":"2026-08-17T18:30:03.363273853Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:55447","title":"Important: libXfont2 security update","description":"X.Org X11 libXfont2 runtime library\n\nSecurity Fix(es):\n\n* libxfont2: Font Server Client encoding[] Out-Of-Bounds Read/Write (CVE-2026-59679)\n\n* libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client (CVE-2026-44950)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-17T18:03:57.407277Z","modified":"2026-08-17T18:30:03.372395026Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:55448","title":"Important: libXfont2 security update","description":"X.Org X11 libXfont2 runtime library\n\nSecurity Fix(es):\n\n* libxfont2: Font Server Client encoding[] Out-Of-Bounds Read/Write (CVE-2026-59679)\n\n* libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client (CVE-2026-44950)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-17T18:06:54.076078Z","modified":"2026-08-17T18:30:03.408459317Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"UBUNTU-CVE-2026-59679","description":"fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a size derived from num_extents in the separate FS_QueryXExtents16 reply. The two CARD32 fields are never cross-checked. A malicious or compromised font server can send a small num_extents (e.g. 1) in the extents reply, then a large num_chars (e.g. 100000) in the bitmaps reply. This causes attacker-controlled out-of-bounds heap read and writes.","status":"published","published":"2026-09-10T09:17:00Z","modified":"2026-09-28T17:30:05.98628852Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T16:56:41.911783Z"},{"id":"ALSA-2026:55446","title":"Important: libXfont2 security update","description":"X.Org X11 libXfont2 runtime library  \n\nSecurity Fix(es):  \n\n  * libxfont2: Font Server Client encoding[] Out-Of-Bounds Read/Write (CVE-2026-59679)\n  * libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client (CVE-2026-44950)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-17T00:00:00Z","modified":"2026-10-29T11:02:29.03506943Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:55447","title":"Important: libXfont2 security update","description":"X.Org X11 libXfont2 runtime library  \n\nSecurity Fix(es):  \n\n  * libxfont2: Font Server Client encoding[] Out-Of-Bounds Read/Write (CVE-2026-59679)\n  * libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client (CVE-2026-44950)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-17T00:00:00Z","modified":"2026-10-29T11:32:24.102301977Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:55448","title":"Important: libXfont2 security update","description":"X.Org X11 libXfont2 runtime library  \n\nSecurity Fix(es):  \n\n  * libxfont2: Font Server Client encoding[] Out-Of-Bounds Read/Write (CVE-2026-59679)\n  * libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client (CVE-2026-44950)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-17T00:00:00Z","modified":"2026-10-29T11:30:38.459667519Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"AZL-101730","title":"CVE-2026-59679 affecting package libXfont2 for versions less than 2.0.9-1","description":"fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a size derived from num_extents in the separate FS_QueryXExtents16 reply. The two CARD32 fields are never cross-checked.\nA malicious or compromised font server can send a small num_extents (e.g. 1) in the extents reply, then a large num_chars (e.g. 100000) in the bitmaps reply. This causes attacker-controlled out-of-bounds heap read and writes.","status":"published","published":"2026-09-10T09:17:02Z","modified":"2026-09-23T14:15:57.208058696Z","updated_at":"2026-11-02T15:28:00.508704Z"},{"id":"CLSA-2026-1787150510","title":"libXfont2: Fix of 2 CVEs","description":"- Fix CVE-2026-59679: out-of-bounds read/write in fs_read_glyphs due to\n  num_chars not being validated against the allocated encoding array size\n  in fserve.c\n  (upstream commit 668fea81f40bcb48ec67fb55d0b851049d265290)\n- Fix CVE-2026-44950: heap buffer overflow in fs_read_glyphs due to a missing\n  bounds check on cumulative glyph data writes into the allbits buffer\n  in fserve.c\n  (upstream commit c2d222bb22c623d8a40f3275077fc7e6617f2c8a)","status":"published","published":"2026-08-19T14:42:02Z","modified":"2026-10-26T09:43:25.560267596Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787162017","title":"libXfont2: Fix of 2 CVEs","description":"- CVE-2026-59679: validate num_chars against the encoding array size in\n  fs_read_glyphs() in src/fc/fserve.c; prevents an out-of-bounds read/write on\n  encoding[] when a font server sends more glyphs than extents\n  (upstream commit 668fea81f40bcb48ec67fb55d0b851049d265290)\n- CVE-2026-44950: bounds-check cumulative glyph data writes in fs_read_glyphs()\n  in src/fc/fserve.c; prevents a heap buffer overflow from overlapping source\n  offsets whose total length exceeds the allocated bitmap buffer\n  (upstream commit c2d222bb22c623d8a40f3275077fc7e6617f2c8a)","status":"published","published":"2026-08-26T09:32:20Z","modified":"2026-10-26T09:43:54.830306542Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1790784764","title":"libXfont2: Fix of 2 CVEs","description":"- rebase to 2.0.3-1.0.3.el7\n- the vendor fixes in this build: CVE-2026-44950, CVE-2026-59679\n- drop the 3 TuxCare CVE backports; the vendor now ships their own patches for them\n- no TuxCare CVE patches remain","status":"published","published":"2026-09-30T16:12:54Z","modified":"2026-10-26T09:31:56.818648033Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790786405","title":"libXfont2: Fix of 2 CVEs","description":"- rebase to 2.0.3-1.0.3.el7\n- the vendor fixes in this build: CVE-2026-44950, CVE-2026-59679\n- drop the 3 TuxCare CVE backports; the vendor now ships their own patches for them\n- no TuxCare CVE patches remain","status":"published","published":"2026-09-30T16:40:14Z","modified":"2026-10-26T09:31:49.525610537Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"MGASA-2026-0471","title":"Updated libxfont2 package fixes security vulnerabilities","description":"fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow\nin libXfont2. (CVE-2026-44950)\nfs_read_glyphs() heap OOB read/write via encoding array index mismatch\nin libXfont2. (CVE-2026-59679)\n","status":"published","published":"2026-10-08T16:23:08Z","modified":"2026-10-08T16:42:40.44927664Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11463-1","title":"libXfont2-2-2.0.7-3.1 on GA media","description":"These are all security issues fixed in the libXfont2-2-2.0.7-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-06T00:00:00Z","modified":"2026-08-07T10:00:44.919525471Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21539-1","title":"Security update for libXfont2","description":"This update for libXfont2 fixes the following issues:\n\n- CVE-2026-44950: fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow (bsc#1272661).\n- CVE-2026-59679: fs_read_glyphs() heap OOB read/write via encoding array index mismatch (bsc#1272660).\n","status":"published","published":"2026-08-06T09:10:31Z","modified":"2026-08-08T18:23:58.446551776Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:23128-1","title":"Security update for libXfont2","description":"This update for libXfont2 fixes the following issues:\n\n- CVE-2026-44950: fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow (bsc#1272661).\n- CVE-2026-59679: fs_read_glyphs() heap OOB read/write via encoding array index mismatch (bsc#1272660).\n","status":"published","published":"2026-08-06T09:11:09Z","modified":"2026-08-14T18:23:45.272978641Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23151-1","title":"Security update for libXfont2","description":"This update for libXfont2 fixes the following issues:\n\n- CVE-2026-44950: fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow (bsc#1272661).\n- CVE-2026-59679: fs_read_glyphs() heap OOB read/write via encoding array index mismatch (bsc#1272660).\n","status":"published","published":"2026-08-06T09:11:09Z","modified":"2026-08-14T18:23:46.278969983Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:3499-1","title":"Security update for libXfont2","description":"This update for libXfont2 fixes the following issues:\n\n- CVE-2026-44950: fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow (bsc#1272661).\n- CVE-2026-59679: fs_read_glyphs() heap OOB read/write via encoding array index mismatch (bsc#1272660).\n","status":"published","published":"2026-08-05T11:56:49Z","modified":"2026-08-06T11:15:07.869728693Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3500-1","title":"Security update for libXfont2","description":"This update for libXfont2 fixes the following issues:\n\n- CVE-2026-44950: fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow (bsc#1272661).\n- CVE-2026-59679: fs_read_glyphs() heap OOB read/write via encoding array index mismatch (bsc#1272660).\n","status":"published","published":"2026-08-05T11:57:55Z","modified":"2026-08-06T11:15:06.526083568Z","updated_at":"2026-11-02T15:54:04.987808Z"}]}}