Heap Overflow Vulnerability in libXfont2 Affecting X.Org Foundation

CVE-2026-59679

What is CVE-2026-59679?

The fs_read_glyphs() function in the libXfont2 font-server client contains a flaw whereby the per-character encoding[] array is indexed using num_chars from the FS_QueryXBitmaps16 reply. However, this array's size is derived from num_extents in the FS_QueryXExtents16 reply, leading to a lack of cross-verification between these parameters. An attacker controlling a malicious font server could exploit this oversight by returning a small num_extents value (e.g., 1) while simultaneously sending a larger num_chars value (e.g., 100000) in the bitmaps reply, resulting in out-of-bounds reads and writes that could be exploited to manipulate the affected system's memory.

References