CVE-2026-56001: libXfont2 BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow
A heap buffer overflow in BitmapScaleBitmaps in libXfont2 before 2.0.8 due to an overflowing 32bit size could be used by attackers able to access the X Server to execute code within the X server cont
Other sources
In libXfont2's BitmapScaleBitmaps() function, a 32-bit variable keeps the number of bytes to allocate. If the value overflows due to excessive per-glyph byte counts, the resulting calloc() allocates a buffer too small for the subsequent operations. An attacker can trigger this by loading a crafted PCF font via SetFontPath + OpenFont at a scale factor that inflates per-glyph byte counts.
— Red Hat
libXfont2 BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.8-1 - Upgrade
Upgrade
debian/libxfontto a version that resolves this vulnerability.Fixed in 1:2.0.4-1+deb11u1Fixed in 1:2.0.6-1+deb12u1Fixed in 1:2.0.6-1+deb13u1Fixed in 1:2.0.8-1 - Upgrade
Upgrade
libXfont2to a version that resolves this vulnerability.Fixed in 2.0.8 - Configuration
Prevent attackers from loading crafted PCF fonts through X Server font-loading (SetFontPath + OpenFont). Only allow trusted font paths and do not accept untrusted PCF files that could trigger BitmapScaleBitmaps integer overflow at an excessive scale factor.
X Server SetFontPath + OpenFont (font loading via supplied PCF files) = Avoid using untrusted/maliciously crafted PCF fonts and font paths - Compensating control
Restrict access to the X Server to trusted clients only (e.g., via network ACL/firewall and authorization), since exploitation requires attackers able to access the X Server to load a crafted PCF font.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56001?
CVE-2026-56001 has a high severity score of 8.5.
How do I fix CVE-2026-56001?
To fix CVE-2026-56001, upgrade libXfont2 to version 2.0.8 or later.
What type of vulnerability is CVE-2026-56001?
CVE-2026-56001 is classified as a heap buffer overflow vulnerability.
Who is affected by CVE-2026-56001?
Users running libXfont2 versions before 2.0.8 on systems that allow access to the X Server are affected.
What can attackers do with CVE-2026-56001?
Attackers can potentially execute arbitrary code within the X server due to the buffer overflow.