# CVE-2026-56002: X.Org libXfont2 heap buffer overflow in pcfReadFont

Source: https://junglewise.ai/threats/cve-2026-56002-x-org-libxfont2-heap-buffer-overflow-in-pcfreadfont  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-56002 · Severity: high · CVSS 8.5 · Published 2026-07-08

libXfont2 is a core library used by the X Window System to handle and display fonts. A vulnerability in how this library processes font files allows a malicious user or application to execute unauthorized code on the system. This could lead to a complete takeover of the X server, potentially exposing user data or allowing an attacker to monitor user activity.

Technologies: [X.Org libXfont2](https://junglewise.ai/threats/technologies/libxfont2). Vendors: [X.Org](https://junglewise.ai/threats/vendors/x-org).

## Quick answers

**Is CVE-2026-56002 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56002 being exploited in the wild.

**How severe is CVE-2026-56002?** High severity, with a CVSS score of 8.5, published 8 July 2026.

**Which products and versions are affected?** X.Org libXfont2 before 2.0.8.

**Is there a fix for CVE-2026-56002?** A patch was published on 2026-06-01: Fix committed to GitLab repository. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56002 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-56002?** Check whether you run X.Org libXfont2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based buffer overflow exists in libXfont2's pcfReadFont() function due to insufficient validation of PCF font files. The library allocates a bitmap buffer based on the 'bitmapSizes' value provided in the file but performs subsequent writes based on per-glyph metrics without verifying they fit within the allocated space. An attacker authenticated as an X client can provide a malicious PCF font with mismatched metrics to trigger the overflow during font parsing. This can result in arbitrary code execution within the context of the X server. The issue is addressed in version 2.0.8 by validating bitmap sizes, offsets, and glyph extents against the actual buffer capacity.

## Affected products

- X.Org libXfont2 before 2.0.8

## Timeline

- 2026-06-01: patched: Fix committed to GitLab repository.
- 2026-07-08: advisory: X.Org Security Advisory released.
- 2026-07-08: disclosed: CVE published to NVD.

## References

- [https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit/b4389e0b1d84a690b819bb27b1439968811a3674](https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit/b4389e0b1d84a690b819bb27b1439968811a3674)
- [https://www.openwall.com/lists/oss-security/2026/07/08/1](https://www.openwall.com/lists/oss-security/2026/07/08/1)

## Related threats

- [libXfont2 out-of-bounds heap access in fs_read_glyphs()](https://junglewise.ai/threats/cve-2026-59679-libxfont2-out-of-bounds-heap-access-in-fs-read-glyphs)
- [X.Org libXfont2 heap buffer overflow in fs_read_glyphs](https://junglewise.ai/threats/cve-2026-44950-x-org-libxfont2-heap-buffer-overflow-in-fs-read-glyphs)
- [X.Org libXfont2 heap buffer overflow in ComputeScaledProperties](https://junglewise.ai/threats/cve-2026-56003-x-org-libxfont2-heap-buffer-overflow-in-computescaledproperties)
- [X.Org libXfont2 heap buffer overflow in BitmapScaleBitmaps](https://junglewise.ai/threats/cve-2026-56001-x-org-libxfont2-heap-buffer-overflow-in-bitmapscalebitmaps)