Quick answers
- Is CVE-2026-56001 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-56001 being exploited in the wild.
- How severe is CVE-2026-56001?
- High severity, with a CVSS score of 8.5, published 8 July 2026.
- Which products and versions are affected?
- X.Org libXfont2 before 2.0.8.
- Is there a fix for CVE-2026-56001?
- A patch was published on 2026-06-01: Fix committed to libXfont repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-56001 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-56001?
- Check whether you run X.Org libXfont2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A heap-based buffer overflow exists in the BitmapScaleBitmaps function within libXfont2 before version 2.0.8. The vulnerability is caused by an integer overflow when calculating the memory allocation size for scaled bitmaps using a 32-bit unsigned integer (bytestoalloc). When the sum of per-glyph byte counts exceeds 2^32, the value wraps around, leading calloc() to allocate an undersized buffer. Subsequent loops then write bitmap data past the end of the allocated memory. An attacker with the ability to load a malicious PCF font (e.g., via SetFontPath and OpenFont) can exploit this to achieve arbitrary code execution within the context of the X Server. The issue is fixed in version 2.0.8 by using size_t for allocation tracking and implementing explicit overflow and maximum allocation checks.
Affected products
- X.Org libXfont2 before 2.0.8
Timeline
- 2026-06-01: patched: Fix committed to libXfont repository
- 2026-07-08: disclosed: Public advisory released by X.Org and SUSE
- 2026-07-08: advisory: NVD record published