CVE-2026-56002
Received Received - Intake

Heap Buffer Overflow in libXfont2

Publication date: 2026-07-08

Last updated on: 2026-07-08

Assigner: SUSE

Description
A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8  allows attackers authenticated as X client to execute code within the X server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-08
Last Modified
2026-07-08
Generated
2026-07-08
AI Q&A
2026-07-08
EPSS Evaluated
N/A
NVD
CVE-2026-56002
EUVD
EUVD-2026-42211

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
libxfont2 libxfont2 to 2.0.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a heap buffer overflow in the function pcfReadFont() within libXfont2 versions before 2.0.8. It occurs because the function does not properly check glyph bounds, which allows an attacker who is authenticated as an X client to execute arbitrary code within the X server.

Impact Analysis

The vulnerability allows an attacker with X client authentication to execute code inside the X server. This can lead to complete compromise of the X server process, potentially allowing the attacker to gain elevated privileges, disrupt services, or access sensitive information.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade libXfont2 to version 2.0.8 or later, where the issue has been fixed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-56002. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart