Quick answers
- Is CVE-2026-44950 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-44950 being exploited in the wild.
- How severe is CVE-2026-44950?
- Critical severity, with a CVSS score of 9, published 10 September 2026.
- Which products and versions are affected?
- X.Org libXfont2 <UNKNOWN>.
- Is there a fix for CVE-2026-44950?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-44950 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-44950?
- Check whether you run X.Org libXfont2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The fs_read_glyphs() function in libXfont2 (src/fc/fserve.c) contains a heap buffer overflow vulnerability. The function copies glyph bitmap data into a pre-allocated buffer but only validates that each individual source glyph's range (position and length) lies within the source bitmap. It fails to check whether the cumulative destination writes exceed the allocated buffer size. A malicious font server can send multiple glyph records with overlapping source offsets—for example, 1000 glyphs each referencing {position:0, length:64}—causing 64KB of data to be written into a 64-byte buffer. The attack is network-reachable and requires no authentication; the attacker must control the font server. This leads to heap corruption with attacker-controlled content, enabling code execution or denial of service.
Affected products
- X.Org libXfont2 <UNKNOWN>
Timeline
- 2026-09-10: disclosed