Log in Start free

Vulnerability · Published Sep 10, 2026 · Assigned by suse

CVE-2026-59679fs_read_glyphs() heap OOB read/write via encoding array index mismatch in libXfont2

Critical 9.0

In plain English

A critical-severity out-of-bounds write in Container suse/kiosk/tigervnc-x11vnc:1.14-63.8 from SUSE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.0Critical
Exploit odds (30 days)0.3%top 82.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a size derived from num_extents in the separate FS_QueryXExtents16 reply. The two CARD32 fields are never cross-checked. A malicious or compromised font server can send a small num_extents (e.g. 1) in the extents reply, then a large num_chars (e.g. 100000) in the bitmaps reply. This causes attacker-controlled out-of-bounds heap read and writes.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10libXfont22.0.6-5.el10_2.3ALSA-2026:55448
AlmaLinux:8libXfont22.0.3-2.el8_10.3ALSA-2026:55446
AlmaLinux:9libXfont22.0.3-12.el9_8.3ALSA-2026:55447
AlmaLinux:10libXfont2-devel2.0.6-5.el10_2.3ALSA-2026:55448
AlmaLinux:8libXfont2-devel2.0.3-2.el8_10.3ALSA-2026:55446
AlmaLinux:9libXfont2-devel2.0.3-12.el9_8.3ALSA-2026:55447
Debian:12libxfontno fix listedDEBIAN-CVE-2026-59679
Debian:13libxfontno fix listedDEBIAN-CVE-2026-59679
Debian:14libxfont1:2.0.9-1DEBIAN-CVE-2026-59679
Rocky Linux:10libXfont20:2.0.6-5.el10_2.3RLSA-2026:55448
Rocky Linux:8libXfont20:2.0.3-2.el8_10.3RLSA-2026:55446
Rocky Linux:9libXfont20:2.0.3-12.el9_8.3RLSA-2026:55447

Affected products (as reported)

VendorProductVersions
SUSE Container suse/kiosk/tigervnc-x11vnc:1.14-63.8 ? – before 2.0.3-150000.3.6.1
SUSE Container suse/kiosk/xorg:21.1-83.7 ? – before 2.0.3-150000.3.6.1
SUSE Image SLES15-SP6-SAP ? – before 2.0.3-150000.3.6.1
SUSE Image SLES15-SP6-SAP-Azure ? – before 2.0.3-150000.3.6.1
SUSE Image SLES15-SP6-SAP-Azure-3P ? – before 2.0.3-150000.3.6.1
SUSE Image SLES15-SP6-SAP-BYOS ? – before 2.0.3-150000.3.6.1
SUSE Image SLES15-SP6-SAP-BYOS-Azure ? – before 2.0.3-150000.3.6.1
SUSE Image SLES15-SP6-SAP-BYOS-EC2 ? – before 2.0.3-150000.3.6.1
SUSE Image SLES15-SP6-SAP-BYOS-GCE ? – before 2.0.3-150000.3.6.1
SUSE Image SLES15-SP6-SAP-EC2 ? – before 2.0.3-150000.3.6.1
SUSE Image SLES15-SP6-SAP-GCE ? – before 2.0.3-150000.3.6.1
SUSE Image SLES15-SP6-SAP-Hardened ? – before 2.0.3-150000.3.6.1
SUSE Image SLES15-SP6-SAP-Hardened-Azure ? – before 2.0.3-150000.3.6.1
SUSE Image SLES15-SP6-SAP-Hardened-BYOS ? – before 2.0.3-150000.3.6.1
SUSE Image SLES15-SP6-SAP-Hardened-BYOS-Azure ? – before 2.0.3-150000.3.6.1
SUSE Image SLES15-SP6-SAP-Hardened-BYOS-EC2 ? – before 2.0.3-150000.3.6.1
SUSE Image SLES15-SP6-SAP-Hardened-BYOS-GCE ? – before 2.0.3-150000.3.6.1
SUSE Image SLES15-SP6-SAP-Hardened-EC2 ? – before 2.0.3-150000.3.6.1
SUSE Image SLES15-SP6-SAP-Hardened-GCE ? – before 2.0.3-150000.3.6.1
SUSE Image SLES15-SP6-SAPCAL ? – before 2.0.3-150000.3.6.1
SUSE Image SLES15-SP6-SAPCAL-Azure ? – before 2.0.3-150000.3.6.1
SUSE Image SLES15-SP6-SAPCAL-EC2 ? – before 2.0.3-150000.3.6.1
SUSE Image SLES15-SP6-SAPCAL-GCE ? – before 2.0.3-150000.3.6.1
SUSE Image SLES15-SP7-SAP-Azure ? – before 2.0.3-150000.3.6.1
SUSE Image SLES15-SP7-SAP-Azure-3P ? – before 2.0.3-150000.3.6.1
SUSE Image SLES15-SP7-SAP-BYOS-Azure ? – before 2.0.3-150000.3.6.1
SUSE Image SLES15-SP7-SAP-BYOS-EC2 ? – before 2.0.3-150000.3.6.1
SUSE Image SLES15-SP7-SAP-BYOS-GCE ? – before 2.0.3-150000.3.6.1
SUSE Image SLES15-SP7-SAP-EC2 ? – before 2.0.3-150000.3.6.1
SUSE Image SLES15-SP7-SAP-GCE ? – before 2.0.3-150000.3.6.1

Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

References