CVE-2026-56003

A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2 ComputeScaledProperties() before libXfont2 before 2.0.8 could be used by attackers using authenticated X clients to execute code within the X server.

CVSS v3 8.5 HIGH

8.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit/dff957a5158da038a282a59a31fe736702732939	Patch
https://www.openwall.com/lists/oss-security/2026/07/08/1	Mailing List Patch Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:x:libxfont:*:*:*:*:*:*:*:*

History

25 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Un desbordamiento de búfer en el heap debido a la falta de verificación de tamaño en el búfer de propiedades al analizar archivos PCF en libXfont2 ComputeScaledProperties() antes de libXfont2 antes de la 2.0.8 podría ser utilizado por atacantes utilizando clientes X autenticados para ejecutar código dentro del servidor X.

Information

Published : 2026-07-08 10:16

Updated : 2026-10-25 20:10

NVD link : CVE-2026-56003

Mitre link : CVE-2026-56003

CVE.ORG link : CVE-2026-56003

JSON object : View

Products Affected

x

libxfont

CWE

CWE-122

Heap-based Buffer Overflow

{"id": "CVE-2026-56003", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-56003", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-08T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "meissner@suse.de", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "meissner@suse.de", "affectedData": [{"repo": "https://gitlab.freedesktop.org/xorg/lib/libxfont/", "vendor": "X.Org", "product": "libXfont2", "versions": [{"status": "affected", "version": "0", "lessThan": "2.0.8", "versionType": "rpm"}], "packageName": "libXfont2", "defaultStatus": "unaffected"}]}], "published": "2026-07-08T10:16:23.577", "references": [{"url": "https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit/dff957a5158da038a282a59a31fe736702732939", "tags": ["Patch"], "source": "meissner@suse.de"}, {"url": "https://www.openwall.com/lists/oss-security/2026/07/08/1", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "source": "meissner@suse.de"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "meissner@suse.de", "description": [{"lang": "en", "value": "CWE-122"}]}], "descriptions": [{"lang": "en", "value": "A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2 ComputeScaledProperties() before libXfont2 before 2.0.8 could be used by attackers using authenticated X clients to execute code within the X server."}, {"lang": "es", "value": "Un desbordamiento de b\u00fafer en el heap debido a la falta de verificaci\u00f3n de tama\u00f1o en el b\u00fafer de propiedades al analizar archivos PCF en libXfont2 ComputeScaledProperties() antes de libXfont2 antes de la 2.0.8 podr\u00eda ser utilizado por atacantes utilizando clientes X autenticados para ejecutar c\u00f3digo dentro del servidor X."}], "lastModified": "2026-10-25T20:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:x:libxfont:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EF6A4D9B-81B8-4FDE-8958-8B08A0AAA937", "versionEndExcluding": "2.0.8", "versionStartIncluding": "2.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "meissner@suse.de"}