CVE-2026-56003: libXfont2 computeProps Property Buffer Heap Buffer Overflow
A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2 ComputeScaledProperties() before libXfont2 before 2.0.8 could be used by attackers using authenticated X clients to execute code within the X server.
Other sources
In libXfont2's ComputeScaledProperties() function, a fixed-size property buffer of 70 slots (1120 bytes) is allocated. The source font properties then trigger a write of 1 slot per unscaled match or 2 slots per scaledX/scaledY match, with no bounds check against the buffer capacity. The PCF parser does not deduplicate properties, so a malicious font can include arbitrarily many properties with the same name atom (e.g. 40 duplicate MINSPACE entries), exceeding the property buffer.
— Red Hat
libXfont2 computeProps Property Buffer Heap Buffer Overflow
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.8-1 - Upgrade
Upgrade
debian/libxfontto a version that resolves this vulnerability.Fixed in 1:2.0.4-1+deb11u1Fixed in 1:2.0.6-1+deb12u1Fixed in 1:2.0.6-1+deb13u1Fixed in 1:2.0.8-1 - Upgrade
Upgrade
libXfont2to a version that resolves this vulnerability.Fixed in 2.0.8 - Compensating control
Restrict access to the X server so that only trusted clients can connect (e.g., limit/deny authenticated X client access from untrusted hosts) to reduce the ability of attackers to send malicious PCF font files.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56003?
CVE-2026-56003 has a severity score of 8.5, categorized as high risk.
How do I fix CVE-2026-56003?
To fix CVE-2026-56003, it is recommended to update libXfont2 to version 2.0.8 or later.
What causes CVE-2026-56003?
CVE-2026-56003 is caused by a heap buffer overflow due to missing size checking when parsing PCF files in libXfont2.
Who is affected by CVE-2026-56003?
Authenticated X clients using versions of libXfont2 prior to 2.0.8 are affected by CVE-2026-56003.
What might an attacker achieve by exploiting CVE-2026-56003?
An attacker exploiting CVE-2026-56003 could execute arbitrary code within the X server.