CVE-2026-56002: libXfont2 PCF Font Parsing Heap Buffer Overflow
A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8 allows attackers authenticated as X client to execute code within the X server.
Other sources
In libXfont2's pcfReadFont() function, the repadded bitmap buffer is allocated using a bitmapSizes[] value read directly from the PCF file without cross-validation against per-glyph metrics. Writing to that array uses the per-glyph metrics from the file also without validation. A malicious PCF font can declare a tiny bitmapSizes[] value (e.g. 16 bytes) for the server's glyph pad index and a per-glyph metrics that exceeds this size, causing a write past the end of the allocation with attacker-controlled content from the PCF BITMAPS payload. No rendering is needed -- the overflow occurs during font parsing itself.
— Red Hat
libXfont2 PCF Font Parsing Heap Buffer Overflow
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.8-1 - Upgrade
Upgrade
debian/libxfontto a version that resolves this vulnerability.Fixed in 1:2.0.4-1+deb11u1Fixed in 1:2.0.6-1+deb12u1Fixed in 1:2.0.6-1+deb13u1Fixed in 1:2.0.8-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56002?
The severity of CVE-2026-56002 is high with a score of 8.5.
How do I fix CVE-2026-56002?
To fix CVE-2026-56002, update libXfont2 to version 2.0.8 or later.
What are the risks associated with CVE-2026-56002?
CVE-2026-56002 poses a risk of code execution within the X server by authenticated attackers due to a heap buffer overflow.
Who is affected by CVE-2026-56002?
Users running versions of libXfont2 prior to 2.0.8 are affected by CVE-2026-56002.
What component of the system is impacted by CVE-2026-56002?
CVE-2026-56002 impacts the font parsing functionality of the X.Org libXfont2 library.