libXfont2 Has a Heap Overflow. A Malicious Font Server Can Reach the X Server
- The Mess: X.Org fixed two serious memory-corruption bugs in libXfont2, including a heap overflow triggered by malicious font-server data.
- The Damage: A compromised or malicious font server can feed crafted glyph data into the X client and potentially turn memory corruption into privilege escalation.
- The Fix: Update libXfont2 to 2.0.9 or the security package supplied by your Linux distribution, and disable legacy font-server support if you do not need it.
libXfont2 is old code doing an old job: talking to X11 font servers.
That legacy interface just produced two nasty vulnerabilities.
CVE-2026-44950 is a heap buffer overflow in fs_read_glyphs(). The function copies glyph bitmap data into a buffer without correctly validating the cumulative size of the incoming data. A malicious font server can therefore provide specially crafted glyph information and overwrite memory outside the allocated heap area.
If the X server runs with elevated privileges, the impact can include privilege escalation. If it runs unprivileged, the immediate result is more likely a crash and denial of service.
The Second Bug Has a Different Shape
CVE-2026-59679 attacks another assumption inside fs_read_glyphs().
The client allocates its encoding[] array based on num_extents, then later uses num_chars from a separate server response to index that array. Those values are not properly cross-checked.
A malicious font server can deliberately make them disagree.
The result is an out-of-bounds heap read and write. X.Org notes that the bug is an incomplete fix for the much older CVE-2014-0210 issue.
That history is worth noticing.
The security boundary was patched before.
The assumption survived.
Why Font Servers Still Matter
Most Linux administrators will never intentionally configure a remote X font server.
That is exactly why this vulnerability is easy to underestimate.
The vulnerable code exists in a widely distributed X.Org library, while enterprise Linux distributions continue to ship it. Red Hat, SUSE, Amazon Linux and Oracle Linux have all issued security updates for the two CVEs.
SUSE rates CVE-2026-44950 at 9.5 CVSS 4.0 and CVE-2026-59679 at 9.2. Its CVSS 3.1 scores are 9.0 for both.
The practical exposure depends heavily on whether font-server support is actually enabled and reachable.
X.Org Changed the Default
The upstream fix does more than repair the two memory bugs.
Starting with libXfont2 2.0.9, font-server support is disabled by default at build time unless --enable-fc is explicitly supplied.
X.Org points out that font servers have been deprecated for years and says most users will not notice the change.
That is a useful defensive change.
Removing an obsolete protocol from the default build is often safer than endlessly trying to make ancient parsing code perfect.
What Linux Administrators Should Do
Check whether libXfont2 is installed and determine which package version your distribution provides.
Then:
- install the vendor security update;
- update to upstream libXfont2 2.0.9 where applicable;
- verify whether font-server support is enabled;
- disable it if your environment does not require it;
- avoid allowing X11 systems to communicate with untrusted font servers;
- restart affected graphical services after the update where required.
On enterprise distributions, use the vendor package rather than replacing system libraries manually. Red Hat and Oracle have already published corrected packages, while SUSE provides its own patched build.
Bugstoday Opinion
This is exactly the sort of vulnerability that survives because everyone assumes the affected protocol died years ago.
It didn’t.
The code stayed in distributions. The interface stayed available. And a parser handling hostile font-server data still had memory-safety bugs.
The best fix here is not complicated.
Patch the library.
Then kill the legacy feature if nobody actually needs it.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
- X.Org Security Advisory — libXfont2
- X.Org — libXfont2 2.0.9
- Red Hat Security Advisory RHSA-2026:61756
- SUSE Security Advisory SUSE-SU-2026:23128-1
- Amazon Linux Security Advisory ALAS2023-2026-2112
- Oracle Linux Security Advisory ELSA-2026-55448
