CVE-2026-59679

Name	CVE-2026-59679
Description	fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a size derived from num_extents in the separate FS_QueryXExtents16 reply. The two CARD32 fields are never cross-checked. A malicious or compromised font server can send a small num_extents (e.g. 1) in the extents reply, then a large num_chars (e.g. 100000) in the bitmaps reply. This causes attacker-controlled out-of-bounds heap read and writes.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libxfont (PTS)	bookworm	1:2.0.6-1	vulnerable
	bookworm (security)	1:2.0.6-1+deb12u1	vulnerable
	trixie (security), trixie	1:2.0.6-1+deb13u1	vulnerable
	forky, sid	1:2.0.9-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libxfont	source	(unstable)	1:2.0.9-1	unimportant

Notes

https://www.openwall.com/lists/oss-security/2026/08/05/1
Fixed by: https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit/668fea81f40bcb48ec67fb55d0b851049d265290 (libXfont2-2.0.9)
Disabled support to connect to font server since 1:1.4.7-1