Infinite Loop Vulnerability in Fluxbox Window Manager
CVE-2026-123785

6.8MEDIUM

Key Information:

Vendor

Fluxbox

Status
Fluxbox
Vendor
CVE Published:
6 November 2026

What is CVE-2026-123785?

The Fluxbox Window Manager versions up to 1.3.7 contain an infinite loop vulnerability in the Menu::updateMenu() function. This issue arises from crafted style geometry values that can induce an unbounded menu.titleHeight. As a result, the loop within the column rendering will never terminate, causing a significant increase in CPU usage. This can lead to a denial of service, particularly affecting system responsiveness at startup as the window manager fails to load properly.

Affected Version(s)

fluxbox 0 <= 1.3.7

References

https://github.com/fluxbox/fluxbox/pull/90
issue-trackingpatch
https://github.com/fluxbox/fluxbox
product
https://github.com/fluxbox/fluxbox/blob/Release-1_3_7/src...
technical-description

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Igor Marcel
.