Executive brief
libXfont2 is a font rendering library used by X11 display servers and desktop environments to load and render fonts from font servers. A malicious or compromised font server can exploit a validation flaw to trigger out-of-bounds memory reads and writes, potentially allowing remote code execution or denial of service on any system using the vulnerable library.
Technical details
The vulnerability exists in fs_read_glyphs() in src/fc/fserve.c, where the function indexes a per-character encoding[] array using num_chars from an FS_QueryXBitmaps16 reply. However, the array was allocated with a size derived from num_extents in a separate FS_QueryXExtents16 reply. These two CARD32 fields are never cross-checked, allowing a mismatch. An attacker controlling a font server can send a small num_extents (e.g., 1) in the extents reply followed by a large num_chars (e.g., 100,000) in the bitmaps reply, causing out-of-bounds heap read and write operations. No authentication is required, as the attack occurs at the font server protocol level. Exploitation leads to memory corruption and potential code execution.
Affected products
- X.Org libXfont2
Timeline
- 2026-09-10: disclosed