fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice (position, length) lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the allocation. A malicious font server can send overlapping source offsets -- for example 1000 glyphs each referencing {position:0, length:64} with nbytes=64. Each individual source range passes the existing validation, but the cumulative writes total 64000 bytes into a 64-byte destination buffer. This is a heap buffer overflow with attacker-controlled content.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Libxfonts2
  • Libxfont2

No data.

No data.

References
Link Providers
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44950 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-44950 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-44950 cve-icon
History

Thu, 10 Sep 2026 08:30:00 +0000

Type Values Removed Values Added
Description A flaw was found in the libXfont2 font-server client. This heap buffer overflow vulnerability allows a malicious font server to send specially crafted glyph data. The fs_read_glyphs() function fails to properly validate the total size of the incoming data, leading to an overwrite of memory beyond the intended buffer. If the X server runs as a privileged user, this could result in privilege escalation, allowing an attacker to gain higher access. If the X server runs as an unprivileged user, it could lead to a denial of service, causing the system to crash. fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice (position, length) lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the allocation. A malicious font server can send overlapping source offsets -- for example 1000 glyphs each referencing {position:0, length:64} with nbytes=64. Each individual source range passes the existing validation, but the cumulative writes total 64000 bytes into a 64-byte destination buffer. This is a heap buffer overflow with attacker-controlled content.
Title libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow in libXfont2
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}

 cvssV4_0

{'score': 9.5, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

cvssV3_1

{'score': 9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H'}

Fri, 07 Aug 2026 10:30:00 +0000

Type Values Removed Values Added
First Time appeared Libxfonts2
Libxfonts2 libxfont2
Vendors & Products Libxfonts2
Libxfonts2 libxfont2

Thu, 06 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
Description A flaw was found in the libXfont2 font-server client. This heap buffer overflow vulnerability allows a malicious font server to send specially crafted glyph data. The fs_read_glyphs() function fails to properly validate the total size of the incoming data, leading to an overwrite of memory beyond the intended buffer. If the X server runs as a privileged user, this could result in privilege escalation, allowing an attacker to gain higher access. If the X server runs as an unprivileged user, it could lead to a denial of service, causing the system to crash.
Title libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client
Weaknesses CWE-120
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}

threat_severity

Important
cve-icon MITRE

Status: PUBLISHED

Assigner: suse

Published: 2026-09-10T08:19:55.462Z

Updated: 2026-09-10T08:19:55.462Z

Reserved: 2026-05-08T12:29:48.969Z

Link: CVE-2026-44950

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-10T09:17:02.490

Modified: 2026-09-10T09:17:02.490

Link: CVE-2026-44950

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-05T10:00:00Z

Links: CVE-2026-44950 - Bugzilla