Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-44950: libXfont2 can overwrite memory with crafted fonts
CVE-2026-44950 · published 11 days ago
Summary
The libXfont2 library used in Debian and several SUSE distributions can write past the end of its memory buffer when processing a specially crafted font file. This could let an attacker run code on the server that handles fonts. Update the libxfont packages to the latest versions or restrict the system to trusted font sources.
What to do
- Update debian libxfont to version 1:2.0.9-1.
- Update suse container suse/kiosk/tigervnc-x11vnc:1.14-63.8 to version 2.0.3-150000.3.6.1 or later.
- Update suse container suse/kiosk/xorg:21.1-83.7 to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp6-sap to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp6-sap-azure to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp6-sap-azure-3p to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp6-sap-byos to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp6-sap-byos-azure to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp6-sap-byos-ec2 to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp6-sap-byos-gce to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp6-sap-ec2 to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp6-sap-gce to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp6-sap-hardened to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp6-sap-hardened-azure to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp6-sap-hardened-byos to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp6-sap-hardened-byos-azure to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp6-sap-hardened-byos-ec2 to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp6-sap-hardened-byos-gce to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp6-sap-hardened-ec2 to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp6-sap-hardened-gce to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp6-sapcal to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp6-sapcal-azure to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp6-sapcal-ec2 to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp6-sapcal-gce to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp7-sap-azure to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp7-sap-azure-3p to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp7-sap-byos-azure to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp7-sap-byos-ec2 to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp7-sap-byos-gce to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp7-sap-ec2 to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp7-sap-gce to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp7-sap-gce-3p to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp7-sap-hardened-azure to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp7-sap-hardened-byos-azure to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp7-sap-hardened-byos-ec2 to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp7-sap-hardened-byos-gce to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp7-sap-hardened-gce to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp7-sapcal-azure to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp7-sapcal-ec2 to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp7-sapcal-gce to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles-sap-azure to version 2.0.7-160000.5.1 or later.
- Update suse image sles-sap-azure-3p to version 2.0.7-160000.5.1 or later.
- Update suse image sles-sap-byos-azure to version 2.0.7-160000.5.1 or later.
- Update suse image sles-sap-byos-ec2 to version 2.0.7-160000.5.1 or later.
- Update suse image sles-sap-byos-gce to version 2.0.7-160000.5.1 or later.
- Update suse image sles-sap-gce to version 2.0.7-160000.5.1 or later.
- Update suse image sles-sap-gce-3p to version 2.0.7-160000.5.1 or later.
- Update suse image sles-sapcal-gce to version 2.0.7-160000.5.1 or later.
- Update suse image sles12-sp5-azure-sap-byos to version 2.0.3-3.6.1 or later.
- Update suse image sles12-sp5-azure-sap-on-demand to version 2.0.3-3.6.1 or later.
- Update suse image sles12-sp5-ec2-sap-byos to version 2.0.3-3.6.1 or later.
- Update suse image sles12-sp5-ec2-sap-on-demand to version 2.0.3-3.6.1 or later.
- Update suse image sles12-sp5-gce-sap-byos to version 2.0.3-3.6.1 or later.
- Update suse image sles12-sp5-gce-sap-on-demand to version 2.0.3-3.6.1 or later.
- Update suse suse liberty linux 10 to version 2.0.6-5.el10_2.3 or later.
- Update suse suse liberty linux 8 to version 2.0.3-2.el8_10.3 or later.
- Update suse suse liberty linux 9 to version 2.0.3-12.el9_8.3 or later.
- Update suse suse linux enterprise desktop 15 sp7 to version 2.0.3-150000.3.6.1 or later.
- Update suse suse linux enterprise module for basesystem 15 sp7 to version 2.0.3-150000.3.6.1 or later.
- Update suse suse linux enterprise server 15 sp7 to version 2.0.3-150000.3.6.1 or later.
- Update suse suse linux enterprise server for sap applications 15 sp7 to version 2.0.3-150000.3.6.1 or later.
- Update suse suse linux enterprise high performance computing 15 sp4-espos to version 2.0.3-150000.3.6.1 or later.
- Update suse suse linux enterprise high performance computing 15 sp4-ltss to version 2.0.3-150000.3.6.1 or later.
- Update suse suse linux enterprise high performance computing 15 sp5-espos to version 2.0.3-150000.3.6.1 or later.
- Update suse suse linux enterprise high performance computing 15 sp5-ltss to version 2.0.3-150000.3.6.1 or later.
- Update suse suse linux enterprise server 12 sp5-ltss to version 2.0.3-3.6.1 or later.
- Update suse suse linux enterprise server 15 sp4-ltss to version 2.0.3-150000.3.6.1 or later.
- Update suse suse linux enterprise server 15 sp5-ltss to version 2.0.3-150000.3.6.1 or later.
- Update suse suse linux enterprise server 15 sp6-ltss to version 2.0.3-150000.3.6.1 or later.
- Update suse suse linux enterprise server 16.0 to version 2.0.7-160000.5.1 or later.
- Update suse suse linux enterprise server for sap applications 16.0 to version 2.0.7-160000.5.1 or later.
- Update suse suse linux enterprise server ltss extended security 12 sp5 to version 2.0.3-3.6.1 or later.
- Update suse suse linux enterprise server for sap applications 15 sp4 to version 2.0.3-150000.3.6.1 or later.
- Update suse suse linux enterprise server for sap applications 15 sp5 to version 2.0.3-150000.3.6.1 or later.
- Update suse suse linux enterprise server for sap applications 15 sp6 to version 2.0.3-150000.3.6.1 or later.
- Update suse suse manager proxy lts 4.3 to version 2.0.3-150000.3.6.1 or later.
- Update suse suse manager retail branch server lts 4.3 to version 2.0.3-150000.3.6.1 or later.
- Update suse suse manager server lts 4.3 to version 2.0.3-150000.3.6.1 or later.
- Update suse opensuse leap 16.0 to version 2.0.7-160000.5.1 or later.
- Update suse opensuse tumbleweed to version 2.0.7-3.1 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:11 | debian | libxfont | All versions |
| Debian:12 | debian | libxfont | All versions |
| Debian:13 | debian | libxfont | All versions |
| Debian:14 | debian | libxfont |
< 1:2.0.9-1 Fix: upgrade to 1:2.0.9-1
|
| – | suse | container suse/kiosk/tigervnc-x11vnc:1.14-63.8 | < 2.0.3-150000.3.6.1 |
| – | suse | container suse/kiosk/xorg:21.1-83.7 | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp6-sap | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp6-sap-azure | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp6-sap-azure-3p | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp6-sap-byos | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp6-sap-byos-azure | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp6-sap-byos-ec2 | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp6-sap-byos-gce | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp6-sap-ec2 | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp6-sap-gce | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp6-sap-hardened | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp6-sap-hardened-azure | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp6-sap-hardened-byos | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp6-sap-hardened-byos-azure | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp6-sap-hardened-byos-ec2 | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp6-sap-hardened-byos-gce | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp6-sap-hardened-ec2 | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp6-sap-hardened-gce | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp6-sapcal | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp6-sapcal-azure | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp6-sapcal-ec2 | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp6-sapcal-gce | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp7-sap-azure | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp7-sap-azure-3p | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp7-sap-byos-azure | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp7-sap-byos-ec2 | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp7-sap-byos-gce | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp7-sap-ec2 | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp7-sap-gce | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp7-sap-gce-3p | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp7-sap-hardened-azure | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp7-sap-hardened-byos-azure | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp7-sap-hardened-byos-ec2 | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp7-sap-hardened-byos-gce | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp7-sap-hardened-gce | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp7-sapcal-azure | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp7-sapcal-ec2 | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp7-sapcal-gce | < 2.0.3-150000.3.6.1 |
| – | suse | image sles-sap-azure | < 2.0.7-160000.5.1 |
| – | suse | image sles-sap-azure-3p | < 2.0.7-160000.5.1 |
| – | suse | image sles-sap-byos-azure | < 2.0.7-160000.5.1 |
| – | suse | image sles-sap-byos-ec2 | < 2.0.7-160000.5.1 |
| – | suse | image sles-sap-byos-gce | < 2.0.7-160000.5.1 |
| – | suse | image sles-sap-gce | < 2.0.7-160000.5.1 |
| – | suse | image sles-sap-gce-3p | < 2.0.7-160000.5.1 |
Showing 50 of 86. Show the rest
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | suse | image sles-sapcal-gce | < 2.0.7-160000.5.1 |
| – | suse | image sles12-sp5-azure-sap-byos | < 2.0.3-3.6.1 |
| – | suse | image sles12-sp5-azure-sap-on-demand | < 2.0.3-3.6.1 |
| – | suse | image sles12-sp5-ec2-sap-byos | < 2.0.3-3.6.1 |
| – | suse | image sles12-sp5-ec2-sap-on-demand | < 2.0.3-3.6.1 |
| – | suse | image sles12-sp5-gce-sap-byos | < 2.0.3-3.6.1 |
| – | suse | image sles12-sp5-gce-sap-on-demand | < 2.0.3-3.6.1 |
| – | suse | suse liberty linux 10 | < 2.0.6-5.el10_2.3 |
| – | suse | suse liberty linux 8 | < 2.0.3-2.el8_10.3 |
| – | suse | suse liberty linux 9 | < 2.0.3-12.el9_8.3 |
| – | suse | suse linux enterprise desktop 15 sp7 | < 2.0.3-150000.3.6.1 |
| – | suse | suse linux enterprise module for basesystem 15 sp7 | < 2.0.3-150000.3.6.1 |
| – | suse | suse linux enterprise server 15 sp7 | < 2.0.3-150000.3.6.1 |
| – | suse | suse linux enterprise server for sap applications 15 sp7 | < 2.0.3-150000.3.6.1 |
| – | suse | suse linux enterprise high performance computing 15 sp4-espos | < 2.0.3-150000.3.6.1 |
| – | suse | suse linux enterprise high performance computing 15 sp4-ltss | < 2.0.3-150000.3.6.1 |
| – | suse | suse linux enterprise high performance computing 15 sp5-espos | < 2.0.3-150000.3.6.1 |
| – | suse | suse linux enterprise high performance computing 15 sp5-ltss | < 2.0.3-150000.3.6.1 |
| – | suse | suse linux enterprise server 12 sp5-ltss | < 2.0.3-3.6.1 |
| – | suse | suse linux enterprise server 15 sp4-ltss | < 2.0.3-150000.3.6.1 |
| – | suse | suse linux enterprise server 15 sp5-ltss | < 2.0.3-150000.3.6.1 |
| – | suse | suse linux enterprise server 15 sp6-ltss | < 2.0.3-150000.3.6.1 |
| – | suse | suse linux enterprise server 16.0 | < 2.0.7-160000.5.1 |
| – | suse | suse linux enterprise server for sap applications 16.0 | < 2.0.7-160000.5.1 |
| – | suse | suse linux enterprise server ltss extended security 12 sp5 | < 2.0.3-3.6.1 |
| – | suse | suse linux enterprise server for sap applications 15 sp4 | < 2.0.3-150000.3.6.1 |
| – | suse | suse linux enterprise server for sap applications 15 sp5 | < 2.0.3-150000.3.6.1 |
| – | suse | suse linux enterprise server for sap applications 15 sp6 | < 2.0.3-150000.3.6.1 |
| – | suse | suse manager proxy lts 4.3 | < 2.0.3-150000.3.6.1 |
| – | suse | suse manager retail branch server lts 4.3 | < 2.0.3-150000.3.6.1 |
| – | suse | suse manager server lts 4.3 | < 2.0.3-150000.3.6.1 |
| – | suse | opensuse leap 16.0 | < 2.0.7-160000.5.1 |
| – | suse | opensuse tumbleweed | < 2.0.7-3.1 |
| – | libxfont | libxfont | <= 2.0.8 |
| Ubuntu:Pro:14.04:LTS | canonical | libxfont | All versions |
| Ubuntu:16.04:LTS | canonical | libxfont2 | All versions |
Original advisory text
fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow in libXfont2
fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice (position, length) lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the allocation. A malicious font server can send overlapping source offsets -- for example 1000 glyphs each referencing {position:0, length:64} with nbytes=64. Each individual source range passes the existing validation, but the cumulative writes total 64000 bytes into a 64-byte destination buffer. This is a heap buffer overflow with attacker-controlled content.
References
- https://security-tracker.debian.org/tracker/CVE-2026-44950 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-44950 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-44950 Third Party Advisory
- https://www.openwall.com/lists/oss-security/2026/08/05/1 Third Party Advisory
- https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44950
Severity
9.9
Critical
Exploitation
EPSS <1%
Type
CWE-122Heap-based Buffer Overflow
Timeline
Published10 Sep 2026
Updated21 Sep 2026
First seen10 Aug 2026
Sources
DEBIAN-CVE-2026-44950 · OSV
CVE-2026-44950 · NVD
CVE-2026-44950 · MITRE
UBUNTU-CVE-2026-44950 · OSV
Track software like this
Free during beta