Bug 2509620 (CVE-2026-59679) - CVE-2026-59679 libxfont2: Font Server Client encoding[] Out-Of-Bounds Read/Write
Summary: CVE-2026-59679 libxfont2: Font Server Client encoding[] Out-Of-Bounds Read/Write
Keywords:
Status: NEW
Alias: CVE-2026-59679
Deadline: 2026-08-05
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2515520
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-07-30 21:31 UTC by OSIDB Bzimport
Modified: 2026-09-01 18:02 UTC (History)
5 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:55446 0 None None None 2026-08-17 03:07:55 UTC
Red Hat Product Errata RHSA-2026:55447 0 None None None 2026-08-17 05:42:37 UTC
Red Hat Product Errata RHSA-2026:55448 0 None None None 2026-08-17 04:01:20 UTC
Red Hat Product Errata RHSA-2026:59311 0 None None None 2026-08-25 06:21:16 UTC
Red Hat Product Errata RHSA-2026:59312 0 None None None 2026-08-25 06:46:09 UTC
Red Hat Product Errata RHSA-2026:61390 0 None None None 2026-08-31 14:27:46 UTC
Red Hat Product Errata RHSA-2026:61755 0 None None None 2026-08-31 17:45:31 UTC
Red Hat Product Errata RHSA-2026:61756 0 None None None 2026-08-31 17:46:03 UTC
Red Hat Product Errata RHSA-2026:61995 0 None None None 2026-09-01 12:18:58 UTC
Red Hat Product Errata RHSA-2026:62123 0 None None None 2026-09-01 15:11:59 UTC
Red Hat Product Errata RHSA-2026:62231 0 None None None 2026-09-01 18:02:48 UTC

Description OSIDB Bzimport 2026-07-30 21:31:34 UTC 
fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using    num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a size derived from num_extents in the separate FS_QueryXExtents16 reply. The two values are never cross-checked, so a malicious font server can send a small num_extents (e.g. 1) followed by a large num_chars (e.g. 100000) to cause out-of-bounds heap reads via NONZEROMETRICS(&encoding[minchar].metrics) and out-of-bounds writes of a heap pointer via encoding[minchar].bits = bits.    When the X server runs as root, this can lead to privilege escalation. When it runs as an unprivileged user, this results in a denial of service (crash). This is caused by an incomplete fix of CVE-2014-0210.
Comment 2 Tomas Hoger 2026-08-06 09:36:42 UTC 
Public now via:
https://www.openwall.com/lists/oss-security/2026/08/05/1

Upstream commit:
https://gitlab.freedesktop.org/xorg/lib/libXfont/-/commit/c5cdb67eba7c35789e034f18e22b269d08170197

Fixed upstream in version: libXfont2-2.0.9
Comment 3 errata-xmlrpc 2026-08-17 03:07:54 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:55446 https://access.redhat.com/errata/RHSA-2026:55446
Comment 4 errata-xmlrpc 2026-08-17 04:01:19 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:55448 https://access.redhat.com/errata/RHSA-2026:55448
Comment 5 errata-xmlrpc 2026-08-17 05:42:36 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:55447 https://access.redhat.com/errata/RHSA-2026:55447
Comment 8 errata-xmlrpc 2026-08-25 06:21:15 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:59311 https://access.redhat.com/errata/RHSA-2026:59311
Comment 9 errata-xmlrpc 2026-08-25 06:46:08 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:59312 https://access.redhat.com/errata/RHSA-2026:59312
Comment 10 errata-xmlrpc 2026-08-31 14:27:45 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:61390 https://access.redhat.com/errata/RHSA-2026:61390
Comment 11 errata-xmlrpc 2026-08-31 17:45:30 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:61755 https://access.redhat.com/errata/RHSA-2026:61755
Comment 12 errata-xmlrpc 2026-08-31 17:46:03 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:61756 https://access.redhat.com/errata/RHSA-2026:61756
Comment 13 errata-xmlrpc 2026-09-01 12:18:57 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:61995 https://access.redhat.com/errata/RHSA-2026:61995
Comment 14 errata-xmlrpc 2026-09-01 15:11:59 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:62123 https://access.redhat.com/errata/RHSA-2026:62123
Comment 15 errata-xmlrpc 2026-09-01 18:02:47 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2026:62231 https://access.redhat.com/errata/RHSA-2026:62231
Note You need to log in before you can comment on or make changes to this bug.