Heap Buffer Overflow in libXfont2 Affects X Server Functionality
CVE-2026-56001

8.5HIGH

Key Information:

Vendor

X.org

Status
Libxfont2
Vendor
CVE Published:
8 July 2026

What is CVE-2026-56001?

A heap buffer overflow vulnerability exists in the BitmapScaleBitmaps function of libXfont2 prior to version 2.0.8. This weakness allows attackers with access to the X Server to exploit the overflowing 32-bit size, potentially executing arbitrary code within the X server context. It is critical for users to apply the necessary updates to mitigate this security risk.

Affected Version(s)

libXfont2 0 < 2.0.8

References

https://www.openwall.com/lists/oss-security/2026/07/08/1
vendor-advisory
https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit...
patch

CVSS V3.1

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Anonymous working with Trend Micro Zero Day Initiative.
.