# CVE-2026-56003: X.Org libXfont2 heap buffer overflow in ComputeScaledProperties

Source: https://junglewise.ai/threats/cve-2026-56003-x-org-libxfont2-heap-buffer-overflow-in-computescaledproperties  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-56003 · Severity: high · CVSS 8.5 · Published 2026-07-08

libXfont2 is a core library used by the X Window System to handle and display fonts. A vulnerability in how this library processes font files allows an attacker to crash the display server or potentially execute malicious code. This could lead to a full system compromise or a disruption of graphical services on affected Linux and Unix-like systems.

Technologies: [X.Org libXfont2](https://junglewise.ai/threats/technologies/libxfont2). Vendors: [X.Org](https://junglewise.ai/threats/vendors/x-org).

## Quick answers

**Is CVE-2026-56003 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56003 being exploited in the wild.

**How severe is CVE-2026-56003?** High severity, with a CVSS score of 8.5, published 8 July 2026.

**Which products and versions are affected?** X.Org libXfont2 before 2.0.8.

**Is there a fix for CVE-2026-56003?** A patch was published on 2026-06-01: Fix committed to GitLab repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56003 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-56003?** Check whether you run X.Org libXfont2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap buffer overflow exists in the ComputeScaledProperties() function of libXfont2 when parsing Portable Compiled Format (PCF) files. The function allocates a fixed-size buffer of 70 slots for font properties, but the computeProps() helper fails to perform bounds checking when writing to this buffer. An attacker can provide a malicious font containing numerous duplicate properties that match entries in the fontPropTable, causing the library to write past the end of the allocated 1120-byte buffer. This can be triggered by an authenticated X client using SetFontPath and OpenFont requests. The issue is resolved in version 2.0.8 by implementing proper capacity checks during property iteration.

## Affected products

- X.Org libXfont2 before 2.0.8

## Timeline

- 2026-06-01: patched: Fix committed to GitLab repository
- 2026-07-08: advisory: X.Org Security Advisory released
- 2026-07-08: disclosed: Public disclosure on oss-security mailing list

## References

- [https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit/dff957a5158da038a282a59a31fe736702732939](https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit/dff957a5158da038a282a59a31fe736702732939)
- [https://www.openwall.com/lists/oss-security/2026/07/08/1](https://www.openwall.com/lists/oss-security/2026/07/08/1)

## Related threats

- [libXfont2 out-of-bounds heap access in fs_read_glyphs()](https://junglewise.ai/threats/cve-2026-59679-libxfont2-out-of-bounds-heap-access-in-fs-read-glyphs)
- [X.Org libXfont2 heap buffer overflow in fs_read_glyphs](https://junglewise.ai/threats/cve-2026-44950-x-org-libxfont2-heap-buffer-overflow-in-fs-read-glyphs)
- [X.Org libXfont2 heap buffer overflow in pcfReadFont](https://junglewise.ai/threats/cve-2026-56002-x-org-libxfont2-heap-buffer-overflow-in-pcfreadfont)
- [X.Org libXfont2 heap buffer overflow in BitmapScaleBitmaps](https://junglewise.ai/threats/cve-2026-56001-x-org-libxfont2-heap-buffer-overflow-in-bitmapscalebitmaps)