CVE-2026-44950
Awaiting Analysis Awaiting Analysis - Queue

Heap Buffer Overflow in libXfont2 Font Server Client

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: SUSE

Description
fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice (position, length) lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the allocation. A malicious font server can send overlapping source offsets -- for example 1000 glyphs each referencing {position:0, length:64} with nbytes=64. Each individual source range passes the existing validation, but the cumulative writes total 64000 bytes into a 64-byte destination buffer. This is a heap buffer overflow with attacker-controlled content.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-30
AI Q&A
2026-09-10
EPSS Evaluated
2026-09-29
NVD
CVE-2026-44950
EUVD
EUVD-2026-75306

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a heap buffer overflow in libXfont2's font-server client. The function fs_read_glyphs() copies glyph bitmaps into a buffer without checking if the cumulative writes exceed the buffer size. Attackers can exploit this by sending many small overlapping glyph references that collectively overflow the destination buffer.

Detection Guidance

This vulnerability involves a heap buffer overflow in libXfont2's font-server client. Detection requires checking for vulnerable versions of libXfont2 and monitoring for unusual font server interactions. No specific commands are provided in the context to detect this issue directly.

Impact Analysis

An attacker could exploit this to execute arbitrary code, crash applications using libXfont2, or gain elevated privileges on systems where malicious font servers are used. The high CVSS score indicates significant risk of remote code execution.

Compliance Impact

This vulnerability is a heap buffer overflow that allows arbitrary code execution with high privileges. It could lead to unauthorized data access, modification, or exfiltration, which directly violates GDPR's data protection requirements and HIPAA's safeguards for protected health information.

Mitigation Strategies

Immediate mitigation steps include updating libXfont2 to the latest patched version, restricting access to font servers, and monitoring for suspicious activity. The context does not provide specific commands or detailed mitigation steps.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-44950. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart