CVE-2026-59679
published 2026-09-10CVE-2026-59679: fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using num_chars from the FS_QueryXBitmaps16…
PriorityP354critical9CVSS 3.1
AVNACHPRNUINSCCHIHAH
EPSS
0.41%
34.6th percentile
fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a size derived from num_extents in the separate FS_QueryXExtents16 reply. The two CARD32 fields are never cross-checked.
A malicious or compromised font server can send a small num_extents (e.g. 1) in the extents reply, then a large num_chars (e.g. 100000) in the bitmaps reply. This causes attacker-controlled out-of-bounds heap read and writes.
Affected
81 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| libxfont2 | libxfont2 | ? – 2.0.8 | — |
| suse | container_suse_kiosk_tigervnc-x11vnc_1.14-63.8 | >= ? < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| suse | container_suse_kiosk_xorg_21.1-83.7 | >= ? < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| suse | image_sles-sap-azure | >= ? < 2.0.7-160000.5.1 | 2.0.7-160000.5.1 |
| suse | image_sles-sap-azure-3p | >= ? < 2.0.7-160000.5.1 | 2.0.7-160000.5.1 |
| suse | image_sles-sap-byos-azure | >= ? < 2.0.7-160000.5.1 | 2.0.7-160000.5.1 |
| suse | image_sles-sap-byos-ec2 | >= ? < 2.0.7-160000.5.1 | 2.0.7-160000.5.1 |
| suse | image_sles-sap-byos-gce | >= ? < 2.0.7-160000.5.1 | 2.0.7-160000.5.1 |
| suse | image_sles-sap-gce | >= ? < 2.0.7-160000.5.1 | 2.0.7-160000.5.1 |
| suse | image_sles-sap-gce-3p | >= ? < 2.0.7-160000.5.1 | 2.0.7-160000.5.1 |
| suse | image_sles-sapcal-gce | >= ? < 2.0.7-160000.5.1 | 2.0.7-160000.5.1 |
| suse | image_sles12-sp5-azure-sap-byos | >= ? < 2.0.3-3.6.1 | 2.0.3-3.6.1 |
| suse | image_sles12-sp5-azure-sap-on-demand | >= ? < 2.0.3-3.6.1 | 2.0.3-3.6.1 |
| suse | image_sles12-sp5-ec2-sap-byos | >= ? < 2.0.3-3.6.1 | 2.0.3-3.6.1 |
| suse | image_sles12-sp5-ec2-sap-on-demand | >= ? < 2.0.3-3.6.1 | 2.0.3-3.6.1 |
| suse | image_sles12-sp5-gce-sap-byos | >= ? < 2.0.3-3.6.1 | 2.0.3-3.6.1 |
| suse | image_sles12-sp5-gce-sap-on-demand | >= ? < 2.0.3-3.6.1 | 2.0.3-3.6.1 |
| suse | image_sles15-sp6-sap | >= ? < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| suse | image_sles15-sp6-sap-azure | >= ? < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| suse | image_sles15-sp6-sap-azure-3p | >= ? < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| suse | image_sles15-sp6-sap-byos | >= ? < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| suse | image_sles15-sp6-sap-byos-azure | >= ? < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| suse | image_sles15-sp6-sap-byos-ec2 | >= ? < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| suse | image_sles15-sp6-sap-byos-gce | >= ? < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| suse | image_sles15-sp6-sap-ec2 | >= ? < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
CVSS provenance
nvdv3.19.0CRITICALCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
nvdv4.09.2CRITICALCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
X.Org libXfont2 Font Server Client encoding out-of-bounds
vuldb·2026-08-13
CVE-2026-59679 X.Org libXfont2 Font Server Client encoding out-of-bounds
A vulnerability described as very critical has been identified in X.Org libXfont2. This vulnerability affects unknown code of the component Font Server Client. The manipulation of the argument encoding results in out-of-bounds read.
This vulnerability was named CVE-2026-59679. The attack may be performed from remote. There is no available exploit.
Red Hat
libxfont2: Font Server Client encoding[] Out-Of-Bounds Read/Write
vendor_redhat·2026-08-05·CVSS 7.5
CVE-2026-59679 [HIGH] libxfont2: Font Server Client encoding[] Out-Of-Bounds Read/Write
libxfont2: Font Server Client encoding[] Out-Of-Bounds Read/Write
A flaw was found in the libXfont2 font-server client. A remote attacker, by operating a malicious font server, could exploit an out-of-bounds read/write vulnerability. This occurs because the client incorrectly handles font data, leading to an out-of-bounds memory access. This can lead to privilege escalation if the X server runs with root privileges, or a denial of service (crash) if it runs as an unprivileged user.
Package: libXfont2 (Red Hat Enterprise Linux 10) - Affected
Package: libXfont2 (Red Hat Enterprise Linux 7) - Affected
Package: libXfont2 (Red Hat Enterprise Linux 8) - Affected
Package: libXfont2 (Red Hat Enterprise Linux 9) - Affected
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-59679 libXfont2: Font Server Client encoding[] Out-Of-Bounds Read/Write [fedora-all]
bugzilla·2026-08-13·CVSS 7.5
CVE-2026-59679 [HIGH] CVE-2026-59679 libXfont2: Font Server Client encoding[] Out-Of-Bounds Read/Write [fedora-all]
CVE-2026-59679 libXfont2: Font Server Client encoding[] Out-Of-Bounds Read/Write [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a size derived from num_extents in the separate FS_QueryXExtents16 reply. The two values are never cross-checked, so a malicious font server can send a small num_extents (e.g. 1) followed by a large num_chars (e.g. 100000) to cause out-of-bounds heap reads via NONZEROMETRICS(&enco
Bugzilla
CVE-2026-59679 libxfont2: Font Server Client encoding[] Out-Of-Bounds Read/Write
bugzilla·2026-07-30·CVSS 7.5
CVE-2026-59679 [HIGH] CVE-2026-59679 libxfont2: Font Server Client encoding[] Out-Of-Bounds Read/Write
CVE-2026-59679 libxfont2: Font Server Client encoding[] Out-Of-Bounds Read/Write
fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a size derived from num_extents in the separate FS_QueryXExtents16 reply. The two values are never cross-checked, so a malicious font server can send a small num_extents (e.g. 1) followed by a large num_chars (e.g. 100000) to cause out-of-bounds heap reads via NONZEROMETRICS(&encoding[minchar].metrics) and out-of-bounds writes of a heap pointer via encoding[minchar].bits = bits. When the X server runs as root, this can lead to privilege escalation. When it runs as an unprivileged user, this results in a denial of
2026-09-10
Published