CVE-2026-59679: fs_read_glyphs() heap OOB read/write via encoding array index mismatch in libXfont2
fsreadglyphs() heap OOB read/write via encoding array index mismatch in libXfont2
Other sources
fsreadglyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two values are never cross-checked, so a malicious font server can send a small numextents (e.g. 1) followed by a large numchars (e.g. 100000) to cause out-of-bounds heap reads via NONZEROMETRICS(&encoding[minchar].metrics) and out-of-bounds writes of a heap pointer via encoding[minchar].bits = bits. When the X server runs as root, this can lead to privilege escalation. When it runs as an unprivileged user, this results in a denial of service (crash). This is caused by an incomplete fix of CVE-2014-0210.
— Red Hat
fsreadglyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never cross-checked. A malicious or compromised font server can send a small numextents (e.g. 1) in the extents reply, then a large numchars (e.g. 100000) in the bitmaps reply. This causes attacker-controlled out-of-bounds heap read and writes.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.9-1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems whose X server uses the affected libXfont2 font-server client are exposed when they communicate with a malicious font server. Impact is privilege escalation if the X server runs as root; otherwise, exploitation causes a denial-of-service crash.
What does an attacker need to exploit it?
An attacker needs to control or operate a font server that the vulnerable X server queries. The malicious server must provide inconsistent FS_QueryXExtents16 and FS_QueryXBitmaps16 reply counts, with num_extents smaller than num_chars.
Is this triggered by malformed font-server protocol responses rather than a local font file?
Yes. The flaw results from separately received FS_QueryXExtents16 and FS_QueryXBitmaps16 replies whose count fields are not cross-checked. A malicious font server can use those replies to drive out-of-bounds reads and a heap-pointer write.