Heap Buffer Overflow in libXfont2 Affects Custom X Clients
CVE-2026-56003

8.5HIGH

Key Information:

Vendor

X.org

Status
Libxfont2
Vendor
CVE Published:
8 July 2026

What is CVE-2026-56003?

The vulnerability in libXfont2 arises from a heap buffer overflow due to inadequate size checking in the property buffer when processing PCF files within the ComputeScaledProperties() function. This flaw enables authenticated X clients to potentially execute arbitrary code within the X server context, posing significant security risks for affected installations. Users are strongly advised to update to libXfont2 version 2.0.8 or later to mitigate this issue.

Affected Version(s)

libXfont2 0 < 2.0.8

References

https://www.openwall.com/lists/oss-security/2026/07/08/1
vendor-advisory
https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit...
patch

CVSS V3.1

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Anonymous working with Trend Micro Zero Day Initiative
.