CVE-2026-44950
A heap buffer overflow exists in the libXfont2 font‑server client. The flaw occurs when the server sends many glyphs that overlap in source offsets, causing cumulative writes that exceed the 64‑byte destination buffer. An attacker can exploit this to crash the client or potentially execute arbitrary code.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
The vulnerability is in the libXfont2 font‑server client used by X Window System implementations. No specific product versions are listed in the available data.
Real-world impact
An attacker who can control a font server can send crafted glyph data that overflows the client’s memory, leading to a crash or the execution of malicious code on the affected system.
Why this severity
The CVSS score of 9.5 reflects a critical heap buffer overflow that allows attacker‑controlled data to be written beyond the bounds of a small buffer. The vulnerability requires no authentication or user interaction, and the impact is high because it can lead to arbitrary code execution.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources