CVE-2026-56003: libXfont2 computeProps Property Buffer Heap Buffer Overflow
A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2 ComputeScaledProperties() before libXfont2 before 2.0.8 could be used by attackers using authenticated X clients to execute code within the X server.
Other sources
libXfont2 computeProps Property Buffer Heap Buffer Overflow
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.8-1 - Upgrade
Upgrade
debian/libxfontto a version that resolves this vulnerability.Fixed in 1:2.0.4-1+deb11u1Fixed in 1:2.0.6-1+deb12u1Fixed in 1:2.0.6-1+deb13u1Fixed in 1:2.0.8-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56003?
CVE-2026-56003 has a severity score of 8.5, categorized as high risk.
How do I fix CVE-2026-56003?
To fix CVE-2026-56003, it is recommended to update libXfont2 to version 2.0.8 or later.
What causes CVE-2026-56003?
CVE-2026-56003 is caused by a heap buffer overflow due to missing size checking when parsing PCF files in libXfont2.
Who is affected by CVE-2026-56003?
Authenticated X clients using versions of libXfont2 prior to 2.0.8 are affected by CVE-2026-56003.
What might an attacker achieve by exploiting CVE-2026-56003?
An attacker exploiting CVE-2026-56003 could execute arbitrary code within the X server.