Heap Buffer Overflow in libXfont2 Affects X Server Functionality
CVE-2026-56002

8.5HIGH

Key Information:

Vendor

X.org

Status
Libxfont2
Vendor
CVE Published:
8 July 2026

What is CVE-2026-56002?

A vulnerability in libXfont2, specifically in the pcfReadFont() function, results from inadequate glyph bounds checking. This deficiency allows authenticated attackers operating as X clients to exploit the heap buffer overflow, potentially executing arbitrary code within the X server environment. It is crucial for users to upgrade to version 2.0.8 or later to mitigate potential risks.

Affected Version(s)

libXfont2 0 < 2.0.8

References

https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit...
patch
https://www.openwall.com/lists/oss-security/2026/07/08/1
vendor-advisory

CVSS V3.1

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Anonymous working with Trend Micro Zero Day Initiative.
.