CVE-2026-59679

CVE Details

Release Date:	2026-09-10
Impact:	Important	What is this?

Description

fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a size derived from num_extents in the separate FS_QueryXExtents16 reply. The two CARD32 fields are never cross-checked. A malicious or compromised font server can send a small num_extents (e.g. 1) in the extents reply, then a large num_chars (e.g. 100000) in the bitmaps reply. This causes attacker-controlled out-of-bounds heap read and writes.

See more information about CVE-2026-59679 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	7.5
Vector String:	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Version:	3.1
Attack Vector:	Network
Attack Complexity:	High
Privileges Required:	None
User Interaction:	Required
Scope:	Unchanged
Confidentiality Impact:	High
Integrity Impact:	High
Availability Impact:	High

Errata information

Platform	Errata	Release Date
Oracle Linux version 10 (libXfont2)	ELSA-2026-55448	2026-08-17
Oracle Linux version 7 (libXfont2)	ELSA-2026-62231-0	2026-09-29
Oracle Linux version 8 (libXfont2)	ELSA-2026-55446	2026-08-17
Oracle Linux version 9 (libXfont2)	ELSA-2026-55447	2026-08-17