CVE-2026-59679
A flaw in the libXfont2 font-server client allows a malicious font server to send mismatched data, causing the client to read or write memory outside its intended bounds. The issue arises when the server reports a small number of extents but a large number of character bitmaps, leading to an out-of-bounds heap access. This can be exploited remotely without authentication.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
The libXfont2 font-server client used in X11 environments, typically on Linux and Unix systems that rely on X11 font services.
Real-world impact
An attacker can read sensitive data from the client’s memory or corrupt it, potentially leading to arbitrary code execution or system compromise.
Why this severity
The CVSS score of 9.2 reflects the high impact of confidentiality, integrity, and availability loss, combined with the fact that the vulnerability can be triggered remotely by an unauthenticated attacker with no special privileges.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources