libXfont2 Font Server Flaws Enable X Server Privilege Escalation

X.Org released libXfont2 2.0.9 to fix two memory-corruption flaws in the font-server client: CVE-2026-59679, an out-of-bounds heap read/write caused by inconsistent character and extent counts in font-server replies, and CVE-2026-44950, a heap-buffer overflow in fs_read_glyphs() caused by cumulative glyph bitmap writes exceeding the allocated buffer. A malicious font server can exploit either vulnerability to crash an unprivileged X server or potentially gain elevated privileges where the X server runs as root; both issues are incomplete fixes for CVE-2014-0210.

Red Hat has issued Important security updates for affected RHEL 10 and RHEL 9 SAP-related Update Services and lifecycle channels. Fixed packages include libXfont2 2.0.6-5.el10_2.3 for RHEL 10, 2.0.3-12.el9_4.3 for RHEL 9.4 channels, and 2.0.3-12.el9_2.3 for RHEL 9.2 channels, covering supported x86_64, aarch64, ppc64le, s390x, and, where applicable, i686 systems. Organizations should apply the relevant vendor updates, particularly on systems operating X servers with root privileges.