Fedora Account System
Red Hat Associate
Red Hat Customer
fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap data into a single allbits buffer allocated to rep->nbytes bytes. The per-glyph validation checks only that each source slice (position, length) lies within the source bitmap buffer, but never checks whether the cumulative destination writes exceed the allocation. A malicious font server can send overlapping source offsets (e.g. 1000 glyphs each referencing {position:0, length:64} with nbytes=64) so that each individual source range passes validation, but the cumulative writes total 64000 bytes into a 64-byte heap buffer. This is a heap buffer overflow with attacker-controlled content and size. When the X server runs as root, this can lead to privilege escalation. When it runs as an unprivileged user, this results in a denial of service (crash). This is caused by an incomplete fix of CVE-2014-0210.
Public now via: https://www.openwall.com/lists/oss-security/2026/08/05/1 Upstream commit: https://gitlab.freedesktop.org/xorg/lib/libXfont/-/commit/2de3cf305c3c9e95410f05fbada967989bcc95af Fixed upstream in version: libXfont2-2.0.9
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:55446 https://access.redhat.com/errata/RHSA-2026:55446
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:55448 https://access.redhat.com/errata/RHSA-2026:55448
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:55447 https://access.redhat.com/errata/RHSA-2026:55447
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:59311 https://access.redhat.com/errata/RHSA-2026:59311
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:59312 https://access.redhat.com/errata/RHSA-2026:59312
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:61390 https://access.redhat.com/errata/RHSA-2026:61390
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On Via RHSA-2026:61755 https://access.redhat.com/errata/RHSA-2026:61755
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2026:61756 https://access.redhat.com/errata/RHSA-2026:61756
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Via RHSA-2026:61995 https://access.redhat.com/errata/RHSA-2026:61995
This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:62123 https://access.redhat.com/errata/RHSA-2026:62123
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2026:62231 https://access.redhat.com/errata/RHSA-2026:62231