Loading vulnerability…
Heap Buffer Overflow in libXfont2 PCF Font Parsing
CVE-2026-56002 is a heap buffer overflow in pcfReadFont() in libXfont2 versions before 2.0.8. The function allocates a repadded bitmap buffer using a PCF bitmapSizes[] value without validating that the allocation accommodates writes derived from per-glyph metrics. A crafted PCF font can declare a small bitmap size and inconsistent glyph metrics, causing out-of-bounds writes containing attacker-controlled data from the BITMAPS payload. The overflow occurs during font parsing, without requiring rendering, and can allow an authenticated X client to execute arbitrary code within the X server.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise the confidentiality, integrity, and availability of the affected X server through arbitrary code execution in its process context. The resulting access is bounded by the X server's privileges; an elevated X server could therefore expose elevated privileges. Heap corruption may also crash the server and disrupt graphical sessions.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround or temporary mitigation is documented.
Patch, then assume compromise.
Upgrade libXfont2 to version 2.0.8 or later, or install a distribution package containing the backported fix. For Debian stable (trixie), upgrade libxfont packages to version 1:2.0.6-1+deb13u1 or later.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
31 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.