====================================================================== X.Org Security Advisory: August 05, 2026
Issues in libXfont2 prior to 2.0.9 ======================================================================
Multiple issues have been found in the libXfont2 library published by X.Org for which we are releasing security fixes in libXfont2-2.0.9.
CVE-2026-59679: Font Server Client encoding Out-Of-Bounds Read/Write
fsreadglyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two values are never cross-checked, so a malicious font server can send a small numextents (e.g. 1) followed by a large numchars (e.g. 100000) to cause out-of-bounds heap reads via NONZEROMETRICS(&encoding[minchar].metrics) and out-of-bounds writes of a heap pointer via encoding[minchar].bits = bits.
When the X server runs as root, this can lead to privilege escalation. When it runs as an unprivileged user, this results in a denial of service (crash).
This is caused by an incomplete fix of CVE-2014-0210.
Fixed in: libXfont2-2.0.9 Fix: https://gitlab.freedesktop.org/xorg/lib/libXfont/-/commit/c5cdb67eba7c35789e034f18e22b269d08170197 Found by: Zhixi "Jace" Sun, independent security researcher
CVE-2026-44950: Font Server Client Cumulative Glyph Data Heap Buffer Overflow
fsreadglyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap data into a single allbits buffer allocated to rep->nbytes bytes. The per-glyph validation checks only that each source slice (position, length) lies within the source bitmap buffer, but never checks whether the cumulative destination writes exceed the allocation. A malicious font server can send overlapping source offsets (e.g. 1000 glyphs each referencing {position:0, length:64} with nbytes=64) so that each individual source range passes validation, but the cumulative writes total 64000 bytes into a 64-byte heap buffer.
This is a heap buffer overflow with attacker-controlled content and size. When the X server runs as root, this can lead to privilege escalation. When it runs as an unprivileged user, this results in a denial of service (crash).
This is caused by an incomplete fix of CVE-2014-0210.
Fixed in: libXfont2-2.0.9 Fix: https://gitlab.freedesktop.org/xorg/lib/libXfont/-/commit/2de3cf305c3c9e95410f05fbada967989bcc95af Found by: Zhixi "Jace" Sun, independent security researcher
X.Org X11 libXfont2 runtime librarySecurity Fix(es): libXfont2: BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow (CVE-2026-56001) libXfont2: PCF Font Parsing Heap Buffer Overflow (CVE-2026-56002) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
X.Org X11 libXfont2 runtime librarySecurity Fix(es): libXfont2: BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow (CVE-2026-56001) libXfont2: PCF Font Parsing Heap Buffer Overflow (CVE-2026-56002) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
X.Org X11 libXfont2 runtime librarySecurity Fix(es): libXfont2: BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow (CVE-2026-56001) libXfont2: PCF Font Parsing Heap Buffer Overflow (CVE-2026-56002) libXfont2: computeProps Property Buffer Heap Buffer Overflow (CVE-2026-56003) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
====================================================================== X.Org Security Advisory: July 08, 2026
Issues in libXfont2 prior to 2.0.8 ======================================================================
Multiple issues have been found in the libXfont2 library published by X.Org for which we are releasing security fixes in libXfont2-2.0.8.
CVE-2026-56001: BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow
In libXfont2's BitmapScaleBitmaps() function, a 32-bit variable keeps the number of bytes to allocate. If the value overflows due to excessive per-glyph byte counts, the resulting calloc() allocates a buffer too small for the subsequent operations. An attacker can trigger this by loading a crafted PCF font via SetFontPath + OpenFont at a scale factor that inflates per-glyph byte counts.
Fixed in: libXfont2-2.0.8 Fix: https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit/be0b08e2d354138d3222b4490e2a77c6ee42f778 Found by: Anonymous working with Trend Micro Zero Day Initiative. (ZDI-CAN-30558)
CVE-2026-56002: PCF Font Parsing Heap Buffer Overflow
In libXfont2's pcfReadFont() function, the repadded bitmap buffer is allocated using a bitmapSizes[] value read directly from the PCF file without cross-validation against per-glyph metrics. Writing to that array uses the per-glyph metrics from the file also without validation.
A malicious PCF font can declare a tiny bitmapSizes[] value (e.g. 16 bytes) for the server's glyph pad index and a per-glyph metrics that exceeds this size, causing a write past the end of the allocation with attacker-controlled content from the PCF BITMAPS payload. No rendering is needed -- the overflow occurs during font parsing itself.
Fixed in: libXfont2-2.0.8 Fix: https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit/b4389e0b1d84a690b819bb27b1439968811a3674 Found by: Anonymous working with Trend Micro Zero Day Initiative. (ZDI-CAN-30559)
CVE-2026-56003: computeProps Property Buffer Heap Buffer Overflow
In libXfont2's ComputeScaledProperties() function, a fixed-size property buffer of 70 slots (1120 bytes) is allocated. The source font properties then trigger a write of 1 slot per unscaled match or 2 slots per scaledX/scaledY match, with no bounds check against the buffer capacity.
The PCF parser does not deduplicate properties, so a malicious font can include arbitrarily many properties with the same name atom (e.g. 40 duplicate MINSPACE entries), exceeding the property buffer.
Fixed in: libXfont2-2.0.8 Fix: https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit/dff957a5158da038a282a59a31fe736702732939 Found by: Anonymous working with Trend Micro Zero Day Initiative. (ZDI-CAN-30560)
A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2 ComputeScaledProperties() before libXfont2 before 2.0.8 could be used by attackers using authenticated X clients to execute code within the X server.
In libXfont2's ComputeScaledProperties() function, a fixed-size property buffer of 70 slots (1120 bytes) is allocated. The source font properties then trigger a write of 1 slot per unscaled match or 2 slots per scaledX/scaledY match, with no bounds check against the buffer capacity. The PCF parser does not deduplicate properties, so a malicious font can include arbitrarily many properties with the same name atom (e.g. 40 duplicate MINSPACE entries), exceeding the property buffer.
A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8 allows attackers authenticated as X client to execute code within the X server.
In libXfont2's pcfReadFont() function, the repadded bitmap buffer is allocated using a bitmapSizes[] value read directly from the PCF file without cross-validation against per-glyph metrics. Writing to that array uses the per-glyph metrics from the file also without validation. A malicious PCF font can declare a tiny bitmapSizes[] value (e.g. 16 bytes) for the server's glyph pad index and a per-glyph metrics that exceeds this size, causing a write past the end of the allocation with attacker-controlled content from the PCF BITMAPS payload. No rendering is needed -- the overflow occurs during font parsing itself.
A heap buffer overflow in BitmapScaleBitmaps in libXfont2 before 2.0.8 due to an overflowing 32bit size could be used by attackers able to access the X Server to execute code within the X server cont