CVE-2026-44950: Critical Heap Overflow in libXfont2 Font Server Client

Executive Summary

A critical heap buffer overflow vulnerability (CVE-2026-44950) has been disclosed in libXfont2, the X.Org font library used by X servers and font-server (xfs) clients across most Linux and Unix distributions. The flaw lives in fs_read_glyphs() in src/fc/fserve.c and carries a CVSS 3.1 score of 9.0 (Critical), with the CVSS 4.0 score rated even higher at 9.5.

CVSS Score: 9.0 (Critical) — CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

fs_read_glyphs() copies each glyph's bitmap data into a single destination buffer. The existing validation only checks that each individual source slice — position and length — lies within the bounds of the source bitmap buffer. It never checks whether the running destination write cursor has exceeded the size of the allocated destination buffer. A malicious or compromised font server can exploit this gap to overflow the heap with attacker-controlled content.

Vulnerability Overview

Root Cause

The X Font Server protocol (xfs) allows a font-server client — typically an X server — to request glyph bitmaps from a remote font server. fs_read_glyphs() iterates over the glyphs returned in the server's reply and copies each one's bitmap bytes into a single destination buffer sized for the expected total.

The per-glyph bounds check only confirms that (position, length) for that glyph falls inside the source bitmap buffer sent by the server — it never tracks or validates the cumulative offset into the destination buffer. A malicious font server can send many glyphs with overlapping source offsets, for example 1,000 glyphs each referencing {position: 0, length: 64} with nbytes: 64. Each individual glyph passes the per-glyph check, but the cumulative writes total 64,000 bytes copied into a buffer allocated for only 64 bytes — a textbook heap buffer overflow with content the attacker fully controls.

Red Hat's tracking of the issue additionally frames this as enabling privilege escalation via the font-server client path, since X servers historically run with elevated privileges on some configurations.

Affected Versions

The upstream fix adds a cumulative bounds check for glyph data writes in fs_read_glyphs(), rejecting replies where the running destination offset would exceed the allocated buffer. A new regression test (test-fserve-read-glyphs.c) accompanies the patch.

Attack Vector

1. Attacker controls or man-in-the-middles a font server (xfs) that a
   victim's X server is configured to query
2. Victim's X server, via libXfont2, opens a font-server client
   connection and requests glyph bitmaps
3. Malicious server replies with overlapping glyph offsets that each
   individually pass the per-glyph bounds check
4. fs_read_glyphs() writes cumulative glyph data past the end of the
   allocated destination buffer
5. Heap metadata or adjacent allocations are corrupted with
   attacker-controlled bytes
6. Memory corruption is leveraged for crash (DoS) or, with further
   exploitation, remote code execution / privilege escalation

Impact of Successful Exploitation

Immediate Remediation

Step 1: Patch libXfont2

# Debian/Ubuntu
sudo apt update && sudo apt install --only-upgrade libxfont2
 
# RHEL/AlmaLinux/Rocky
sudo dnf update libXfont2
 
# SUSE
sudo zypper update libXfont2

Confirm the installed version is 2.0.9 or later:

dpkg -s libxfont2 | grep Version    # Debian/Ubuntu
rpm -q libXfont2                     # RHEL family

Step 2: Disable Font-Server Usage If Not Required

Most modern desktop systems no longer rely on the legacy xfs font-server protocol (fonts are typically resolved locally via fontconfig). If your environment does not require font-server clients:

1. Check /etc/X11/xorg.conf (or xorg.conf.d) for FontPath entries referencing tcp/ font-server addresses
2. Remove or comment out any remote font-server FontPath entries
3. Restart the X server to apply changes

If Immediate Patching Is Not Possible

1. Block outbound font-server (xfs) connections at the host or network firewall level (default port 7100/tcp)
2. Restrict font-server clients to only trusted, internally-hosted font servers
3. Monitor for crashes in X server or font-client processes that could indicate exploitation attempts

Detection Indicators

Related Vulnerability

CVE-2026-44950 was disclosed alongside a related, equally critical flaw in the same function — see CVE-2026-59679: libXfont2 Out-of-Bounds Read/Write.

Post-Remediation Steps

1. Confirm libXfont2 updated to 2.0.9 or later across all affected hosts
2. Audit FontPath configuration for any remaining remote font-server references
3. Review firewall rules governing outbound access to font-server ports
4. Watch vendor advisories for backported fixes on LTS/enterprise distributions
5. Re-scan systems with vulnerability management tooling once patches are confirmed deployed

References

• AlmaLinux — Fix CVE-2026-44950: heap buffer overflow in fs_read_glyphs()
• Red Hat — RHSA-2026:55447
• NIST NVD — CVE-2026-44950

Related Reading

• CVE-2026-59679: libXfont2 Out-of-Bounds Read/Write