CVE-2026-56002: libXfont2 PCF Font Parsing Heap Buffer Overflow
A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8 allows attackers authenticated as X client to execute code within the X server.
Other sources
libXfont2 PCF Font Parsing Heap Buffer Overflow
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.8-1 - Upgrade
Upgrade
debian/libxfontto a version that resolves this vulnerability.Fixed in 1:2.0.4-1+deb11u1Fixed in 1:2.0.6-1+deb12u1Fixed in 1:2.0.6-1+deb13u1Fixed in 1:2.0.8-1 - Upgrade
Upgrade
libXfont2to a version that resolves this vulnerability.Fixed in 2.0.8
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56002?
The severity of CVE-2026-56002 is high with a score of 8.5.
How do I fix CVE-2026-56002?
To fix CVE-2026-56002, update libXfont2 to version 2.0.8 or later.
What are the risks associated with CVE-2026-56002?
CVE-2026-56002 poses a risk of code execution within the X server by authenticated attackers due to a heap buffer overflow.
Who is affected by CVE-2026-56002?
Users running versions of libXfont2 prior to 2.0.8 are affected by CVE-2026-56002.
What component of the system is impacted by CVE-2026-56002?
CVE-2026-56002 impacts the font parsing functionality of the X.Org libXfont2 library.