CVE-2026-59679
Received Received - Intake

Integer Overflow in libXfont2 Font Server Client

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: SUSE

Description
fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a size derived from num_extents in the separate FS_QueryXExtents16 reply. The two CARD32 fields are never cross-checked. A malicious or compromised font server can send a small num_extents (e.g. 1) in the extents reply, then a large num_chars (e.g. 100000) in the bitmaps reply. This causes attacker-controlled out-of-bounds heap read and writes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-59679
EUVD
EUVD-2026-75300

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a heap-based buffer overflow in libXfont2's font-server client. The vulnerability occurs when the fs_read_glyphs() function uses an incorrect array size for per-character encoding. A malicious font server can send mismatched data in two separate replies, causing out-of-bounds heap reads and writes.

Detection Guidance

This vulnerability involves a mismatch between num_extents and num_chars in font server replies. Detection requires monitoring font server interactions for malformed replies. Check X font server logs for unusual encoding array sizes or out-of-bounds access errors. Use network traffic analysis tools like Wireshark to inspect FS_QueryXExtents16 and FS_QueryXBitmaps16 replies for inconsistent values.

Impact Analysis

An attacker could exploit this to execute arbitrary code, crash applications using libXfont2, or potentially gain elevated privileges on the system. It may allow remote code execution if a user connects to a malicious font server.

Mitigation Strategies

Immediately update libXfont2 to the latest patched version. Disable or restrict access to untrusted font servers. Monitor network traffic for suspicious font server communications. Apply firewall rules to limit exposure to font server ports. Review system logs for signs of exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59679. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart