Executive Summary
A second critical vulnerability, CVE-2026-59679, has been disclosed in libXfont2 alongside CVE-2026-44950, both located in the font-server client's fs_read_glyphs() function in src/fc/fserve.c. This flaw is an out-of-bounds read and write caused by two unrelated protocol replies whose sizes are never cross-checked against each other. It carries a CVSS 3.1 score of 9.0 (Critical) and a CVSS 4.0 score of 9.2.
CVSS Score: 9.0 (Critical) — CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
fs_read_glyphs() indexes a per-character encoding[] array using num_chars taken from the FS_QueryXBitmaps16 reply. However, that array was allocated earlier with a size derived from num_extents in a separate FS_QueryXExtents16 reply. Because the two CARD32 fields come from different protocol messages and are never validated against each other, a malicious font server can make them disagree.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-59679 |
| CVSS Score | 9.0 (Critical), 9.2 under CVSS 4.0 |
| Type | Out-of-Bounds Read/Write (CWE-125 / CWE-787) |
| Component | libXfont2 font-server client — src/fc/fserve.c, fs_read_glyphs() |
| Attack Vector | Network (malicious/compromised font server) |
| Privileges Required | None |
| User Interaction | None (client connects to attacker-controlled or MITM'd font server) |
| Reserved | 2026-07-06 |
| Published | 2026-09-10 |
| Assigner | SUSE |
Root Cause
The X Font Server protocol splits glyph metadata across two separate reply messages: FS_QueryXExtents16 (which reports num_extents, used to size the encoding[] array at allocation time) and FS_QueryXBitmaps16 (which reports num_chars, used later to index into that same array). Both fields are CARD32 values supplied by the remote font server, and nothing in fs_read_glyphs() verifies that num_chars does not exceed the array size that was actually allocated based on num_extents.
A malicious font server can exploit this directly: send a small num_extents (e.g. 1) in the extents reply so a tiny encoding[] array is allocated, then send a large num_chars (e.g. 100000) in the subsequent bitmaps reply. The client will index far outside the bounds of the allocated array, producing attacker-influenced out-of-bounds heap reads and writes.
Affected Versions
| Component | Affected Versions | Fixed Version |
|---|---|---|
| libXfont2 | ≤ 2.0.8 | 2.0.9 |
The upstream fix validates that num_chars from the FS_QueryXBitmaps16 reply does not exceed the encoding[] array size established during FS_QueryXExtents16 handling, rejecting mismatched replies before any indexing occurs. A regression test accompanies the fix.
Attack Vector
1. Attacker controls or man-in-the-middles a font server (xfs) that a
victim's X server is configured to query
2. Victim's X server, via libXfont2, sends an FS_QueryXExtents16
request and receives a reply with a small num_extents value
3. Client allocates encoding[] sized for that small num_extents
4. Victim sends a follow-up FS_QueryXBitmaps16 request; malicious
server replies with a much larger num_chars value
5. fs_read_glyphs() indexes encoding[] using the larger, unchecked
num_chars, reading and writing past the allocated array
6. Out-of-bounds memory access corrupts heap state or leaks adjacent
memory contents, usable for crash or further exploitationImpact of Successful Exploitation
| Impact | Description |
|---|---|
| Out-of-Bounds Write | Heap corruption via writes indexed past the allocated array |
| Out-of-Bounds Read | Potential disclosure of adjacent heap memory contents |
| Denial of Service | Crash of the font-server client process (commonly the X server) |
| Remote Code Execution | Plausible with further heap-grooming exploitation, though no public PoC exists yet |
Immediate Remediation
Step 1: Patch libXfont2
# Debian/Ubuntu
sudo apt update && sudo apt install --only-upgrade libxfont2
# RHEL/AlmaLinux/Rocky
sudo dnf update libXfont2
# SUSE
sudo zypper update libXfont2Confirm the installed version is 2.0.9 or later:
dpkg -s libxfont2 | grep Version # Debian/Ubuntu
rpm -q libXfont2 # RHEL familyStep 2: Disable Font-Server Usage If Not Required
As with CVE-2026-44950, this flaw is only reachable through the legacy xfs font-server protocol. If your environment does not require remote font-server clients:
- Check
/etc/X11/xorg.conf(orxorg.conf.d) forFontPathentries referencingtcp/font-server addresses - Remove or comment out any remote font-server
FontPathentries - Restart the X server to apply changes
If Immediate Patching Is Not Possible
- Block outbound font-server (xfs) connections at the host or network firewall level (default port 7100/tcp)
- Restrict font-server clients to only trusted, internally-hosted font servers
- Monitor for crashes in X server or font-client processes that could indicate exploitation attempts
Detection Indicators
| Indicator | Description |
|---|---|
Unexpected X server or xfs client crashes | Possible failed exploitation attempts |
| Connections to unfamiliar font-server (port 7100/tcp) endpoints | Potential malicious font server |
Core dumps referencing fs_read_glyphs or fserve.c | Strong indicator of attempted exploitation |
Related Vulnerability
CVE-2026-59679 was disclosed alongside a related, equally critical flaw in the same function — see CVE-2026-44950: libXfont2 Heap Overflow.
Post-Remediation Steps
- Confirm libXfont2 updated to 2.0.9 or later across all affected hosts
- Audit
FontPathconfiguration for any remaining remote font-server references - Review firewall rules governing outbound access to font-server ports
- Watch vendor advisories for backported fixes on LTS/enterprise distributions
- Re-scan systems with vulnerability management tooling once patches are confirmed deployed
References
- AlmaLinux — Fix CVE-2026-59679: validate num_chars in fs_read_glyphs
- Red Hat — RHSA-2026:55447
- NIST NVD — CVE-2026-59679