fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice (position, length) lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the allocation.

A malicious font server can send overlapping source offsets -- for example 1000 glyphs each referencing {position:0, length:64} with nbytes=64. Each individual source range passes the existing validation, but the cumulative writes total 64000 bytes into a 64-byte destination buffer. This is a heap buffer overflow with attacker-controlled content.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00438.

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Vendors Products
Libxfonts2 Subscribe
Libxfont2 Subscribe

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Libxfonts2 Subscribe
Libxfont2 Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44950 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-44950 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-44950 cve-icon
History

Thu, 10 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-122

Thu, 10 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 10 Sep 2026 08:30:00 +0000

Type Values Removed Values Added
Description A flaw was found in the libXfont2 font-server client. This heap buffer overflow vulnerability allows a malicious font server to send specially crafted glyph data. The fs_read_glyphs() function fails to properly validate the total size of the incoming data, leading to an overwrite of memory beyond the intended buffer. If the X server runs as a privileged user, this could result in privilege escalation, allowing an attacker to gain higher access. If the X server runs as an unprivileged user, it could lead to a denial of service, causing the system to crash. fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice (position, length) lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the allocation. A malicious font server can send overlapping source offsets -- for example 1000 glyphs each referencing {position:0, length:64} with nbytes=64. Each individual source range passes the existing validation, but the cumulative writes total 64000 bytes into a 64-byte destination buffer. This is a heap buffer overflow with attacker-controlled content.
Title libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow in libXfont2
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}

 cvssV4_0

{'score': 9.5, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

cvssV3_1

{'score': 9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H'}

Fri, 07 Aug 2026 10:30:00 +0000

Type Values Removed Values Added
First Time appeared Libxfonts2
Libxfonts2 libxfont2
Vendors & Products Libxfonts2
Libxfonts2 libxfont2

Thu, 06 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
Description A flaw was found in the libXfont2 font-server client. This heap buffer overflow vulnerability allows a malicious font server to send specially crafted glyph data. The fs_read_glyphs() function fails to properly validate the total size of the incoming data, leading to an overwrite of memory beyond the intended buffer. If the X server runs as a privileged user, this could result in privilege escalation, allowing an attacker to gain higher access. If the X server runs as an unprivileged user, it could lead to a denial of service, causing the system to crash.
Title libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client
Weaknesses CWE-120
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}

threat_severity

Important

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: suse

Published:

Updated: 2026-09-10T18:26:50.408Z

Reserved: 2026-05-08T12:29:48.969Z

Link: CVE-2026-44950

cve-icon Vulnrichment

Updated: 2026-09-10T17:20:03.815Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-10T09:17:02.490

Modified: 2026-09-10T19:17:27.730

Link: CVE-2026-44950

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-05T10:00:00Z

Links: CVE-2026-44950 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-10T23:30:12Z

Weaknesses