Loading vulnerability…
Heap buffer overflow in libXfont2 ComputeScaledProperties()
CVE-2026-56003 is a heap buffer overflow in ComputeScaledProperties() in libXfont2 versions before 2.0.8. The function allocates a fixed-size font-property buffer containing 70 slots, totaling 1120 bytes, but writes one slot per unscaled property match or two slots per scaledX/scaledY match without checking the remaining capacity. Because the PCF parser does not deduplicate properties, a crafted font containing repeated matching property names can cause writes beyond the allocation. Authenticated X clients can exploit the vulnerability to execute arbitrary code within the X server.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise the confidentiality, integrity, and availability of the X server and resources accessible to its process. Arbitrary code executes with the X server's privileges; if the server runs with elevated privileges, this can enable privilege escalation. Heap corruption can also crash the server, disrupting connected graphical sessions.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is documented. Pending patching, restrict X-server access to trusted authenticated clients and prevent untrusted PCF fonts from being loaded. These measures reduce exposure but do not correct the buffer overflow.
Patch, then assume compromise.
Upgrade libXfont2 to version 2.0.8 or later, or install the operating-system vendor's patched package. For Debian stable (trixie), upgrade libxfont to version 1:2.0.6-1+deb13u1 or later. Source-built installations should incorporate the upstream fix for unchecked property-buffer writes in ComputeScaledProperties().
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
26 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.