Executive brief
A vulnerability exists in a core font-handling library used by the X Window System, which manages graphical displays on Linux and Unix-like operating systems. By providing a specially crafted font file, an attacker can cause the system to crash or potentially execute malicious code with the privileges of the display server. This could lead to a full system compromise or unauthorized access to user data and active sessions.
Technical details
A heap-based buffer overflow exists in the BitmapScaleBitmaps function within libXfont2 before version 2.0.8. The vulnerability is caused by an integer overflow when calculating the memory allocation size for scaled bitmaps using a 32-bit unsigned integer (bytestoalloc). When the sum of per-glyph byte counts exceeds 2^32, the value wraps around, leading calloc() to allocate an undersized buffer. Subsequent loops then write bitmap data past the end of the allocated memory. An attacker with the ability to load a malicious PCF font (e.g., via SetFontPath and OpenFont) can exploit this to achieve arbitrary code execution within the context of the X Server. The issue is fixed in version 2.0.8 by using size_t for allocation tracking and implementing explicit overflow and maximum allocation checks.
Affected products
- X.Org libXfont2 before 2.0.8
Timeline
- 2026-06-01: patched: Fix committed to libXfont repository
- 2026-07-08: disclosed: Public advisory released by X.Org and SUSE
- 2026-07-08: advisory: NVD record published