CVE-2026-123785: Fluxbox through 1.3.7 Infinite Loop via Menu::updateMenu() Style Geometry
Fluxbox through 1.3.7 contains an infinite loop vulnerability in Menu::updateMenu() in src/FbTk/Menu.cc that allows attackers to hang the window manager via crafted style geometry values. Attackers can supply a style with an oversized unbounded menu.titleHeight so the column loop never terminates, causing sustained CPU use and denial of service at startup.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Fluxbox installations through version 1.3.7 are affected when they load a style containing an oversized, unbounded menu.titleHeight value.
What does an attacker need to do to trigger the denial of service?
The attacker must be able to supply a crafted Fluxbox style. The malicious style uses a menu.titleHeight value that causes the menu column loop not to terminate.
How can I recognize that a system has been affected?
Fluxbox can hang during startup and sustain high CPU use. The condition is associated with processing style geometry for menu.titleHeight.