CVE-2026-59679

CVE-2026-59679 · fs_read_glyphs() heap OOB read/write via encoding array index mismatch in libXfont2

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a size derived from num_extents in the separate FS_QueryXExtents16 reply. The two CARD32 fields are never cross-checked. A malicious or compromised font server can send a small num_extents (e.g. 1) in the extents reply, then a large num_chars (e.g. 100000) in the bitmaps reply. This causes attacker-controlled out-of-bounds heap read and writes.

CVSS 9.2 · Critical · EPSS 0.3% · Fix available

Published

2026-09-10T08:15:24.892Z

Updated

2026-09-10T12:45:33.969Z

Stack: system

Check your server →