UBUNTU-CVE-2026-123785: Medium severity ubuntu/fluxbox vulnerability
Fluxbox through 1.3.7 contains an infinite loop vulnerability in Menu::updateMenu() in src/FbTk/Menu.cc that allows attackers to hang the window manager via crafted style geometry values. Attackers can supply a style with an oversized unbounded menu.titleHeight so the column loop never terminates, causing sustained CPU use and denial of service at startup.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this denial of service condition?
Systems running Fluxbox through version 1.3.7 are affected when Fluxbox processes a style containing an oversized, unbounded menu.titleHeight value. The impact is a hang of the window manager with sustained CPU use during startup.
What must an attacker provide to trigger the issue?
The attacker must supply a crafted Fluxbox style with a menu.titleHeight geometry value large enough to cause the column loop in Menu::updateMenu() not to terminate. Exploitation requires user interaction, as reflected in the UI:R vector.
How can administrators identify likely exposure?
Check whether the system uses Fluxbox through 1.3.7 and whether it loads untrusted or externally supplied style files. Affected behavior may appear as Fluxbox hanging at startup while consuming sustained CPU after a crafted style is applied.