Loading story…
German government CERT advisories disclosed multiple vulnerabilities in FontForge packages for Red Hat Enterprise Linux, warning that the flaws could allow arbitrary code execution. One advisory described multiple vulnerabilities affecting the font editor, while a later notice highlighted an additional vulnerability with the same impact, indicating continued security issues in the software component.
The notices identify FontForge on Red Hat Enterprise Linux as the affected product and classify the risk as code execution, a high-impact outcome that can let attackers run malicious code on vulnerable systems. Organizations using FontForge in Red Hat Enterprise Linux environments should review the relevant vendor advisories, determine affected package versions, and prioritize patching or other remediation to reduce exposure.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
dCERT later released Advisory 2026-0946 for Red Hat Enterprise Linux involving FontForge, describing a vulnerability that allows code execution.
dCERT published Advisory 2026-0314 for Red Hat Enterprise Linux involving FontForge, stating that multiple vulnerabilities could allow code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
X.Org released **libXfont2 2.0.9** to fix two memory-corruption flaws in the font-server client: **CVE-2026-59679**, an out-of-bounds heap read/write caused by inconsistent character and extent counts in font-server replies, and **CVE-2026-44950**, a heap-buffer overflow in `fs_read_glyphs()` caused by cumulative glyph bitmap writes exceeding the allocated buffer. A malicious font server can exploit either vulnerability to crash an unprivileged X server or potentially gain elevated privileges where the X server runs as root; both issues are incomplete fixes for **CVE-2014-0210**. Red Hat has issued Important security updates for affected RHEL 10 and RHEL 9 SAP-related Update Services and lifecycle channels. Fixed packages include **libXfont2 2.0.6-5.el10_2.3** for RHEL 10, **2.0.3-12.el9_4.3** for RHEL 9.4 channels, and **2.0.3-12.el9_2.3** for RHEL 9.2 channels, covering supported x86_64, aarch64, ppc64le, s390x, and, where applicable, i686 systems. Organizations should apply the relevant vendor updates, particularly on systems operating X servers with root privileges.
Sep 1, 2026
Red Hat issued security advisories covering **Linux kernel vulnerabilities** that affect multiple products, including **Red Hat Enterprise Linux (RHEL)**, **RHEL Server**, **RHEL for Real Time**, and **Red Hat CodeReady Linux Builder** across several versions and platforms. A related notice from the Canadian Centre for Cyber Security summarized advisories published during the reporting period and directed administrators to review Red Hat's official guidance. The available notices do not provide specific `CVE` identifiers, exploitation details, or attribution, but they emphasize that affected organizations should identify impacted systems and apply the relevant Red Hat updates. The advisories are presented as routine but important remediation guidance for enterprises running Red Hat-based environments where kernel-level flaws could affect system security and stability.
Jul 20, 2026
Red Hat disclosed **CVE-2026-78376**, an Important-severity use-after-free vulnerability in **WebKitGTK** that can be triggered when a target processes maliciously crafted web content. The memory-handling flaw can cause memory corruption and may lead to **remote code execution**, with Red Hat assigning a **CVSS v3.1 score of 8.8**. Red Hat said exploitation typically requires a user to load untrusted content, but warned that in **`gnome-shell`** the issue may be reachable from the local network without user interaction. Affected products include packages in **Red Hat Enterprise Linux 7, 8, and 9**, while **RHEL 6** is outside support scope. Red Hat’s bug tracker said the issue was remediated through improved memory handling, and noted that **Apple platforms are not affected**. The vendor advised organizations to reduce exposure by avoiding untrusted web content and, where operationally feasible, removing vulnerable WebKitGTK packages until patched updates are applied.
Aug 25, 2026