Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2026-59679: libXfont2 font client may read/write memory unexpectedly
CVE-2026-59679 · published 11 days ago
Summary
The libXfont2 library used in Debian and several SUSE Linux images can be fooled by a malicious font server into reading and writing memory outside its allocated area. This occurs because the software does not verify that two size values sent by the server match, allowing an attacker to trigger out‑of‑bounds access. Update the libXfont2 package to the latest version or apply the vendor’s security patch to fix the issue.
What to do
- Update debian libxfont to version 1:2.0.9-1.
- Update suse container suse/kiosk/tigervnc-x11vnc:1.14-63.8 to version 2.0.3-150000.3.6.1 or later.
- Update suse container suse/kiosk/xorg:21.1-83.7 to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp6-sap to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp6-sap-azure to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp6-sap-azure-3p to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp6-sap-byos to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp6-sap-byos-azure to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp6-sap-byos-ec2 to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp6-sap-byos-gce to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp6-sap-ec2 to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp6-sap-gce to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp6-sap-hardened to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp6-sap-hardened-azure to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp6-sap-hardened-byos to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp6-sap-hardened-byos-azure to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp6-sap-hardened-byos-ec2 to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp6-sap-hardened-byos-gce to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp6-sap-hardened-ec2 to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp6-sap-hardened-gce to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp6-sapcal to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp6-sapcal-azure to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp6-sapcal-ec2 to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp6-sapcal-gce to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp7-sap-azure to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp7-sap-azure-3p to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp7-sap-byos-azure to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp7-sap-byos-ec2 to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp7-sap-byos-gce to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp7-sap-ec2 to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp7-sap-gce to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp7-sap-gce-3p to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp7-sap-hardened-azure to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp7-sap-hardened-byos-azure to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp7-sap-hardened-byos-ec2 to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp7-sap-hardened-byos-gce to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp7-sap-hardened-gce to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp7-sapcal-azure to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp7-sapcal-ec2 to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles15-sp7-sapcal-gce to version 2.0.3-150000.3.6.1 or later.
- Update suse image sles-sap-azure to version 2.0.7-160000.5.1 or later.
- Update suse image sles-sap-azure-3p to version 2.0.7-160000.5.1 or later.
- Update suse image sles-sap-byos-azure to version 2.0.7-160000.5.1 or later.
- Update suse image sles-sap-byos-ec2 to version 2.0.7-160000.5.1 or later.
- Update suse image sles-sap-byos-gce to version 2.0.7-160000.5.1 or later.
- Update suse image sles-sap-gce to version 2.0.7-160000.5.1 or later.
- Update suse image sles-sap-gce-3p to version 2.0.7-160000.5.1 or later.
- Update suse image sles-sapcal-gce to version 2.0.7-160000.5.1 or later.
- Update suse image sles12-sp5-azure-sap-byos to version 2.0.3-3.6.1 or later.
- Update suse image sles12-sp5-azure-sap-on-demand to version 2.0.3-3.6.1 or later.
- Update suse image sles12-sp5-ec2-sap-byos to version 2.0.3-3.6.1 or later.
- Update suse image sles12-sp5-ec2-sap-on-demand to version 2.0.3-3.6.1 or later.
- Update suse image sles12-sp5-gce-sap-byos to version 2.0.3-3.6.1 or later.
- Update suse image sles12-sp5-gce-sap-on-demand to version 2.0.3-3.6.1 or later.
- Update suse suse liberty linux 10 to version 2.0.6-5.el10_2.3 or later.
- Update suse suse liberty linux 8 to version 2.0.3-2.el8_10.3 or later.
- Update suse suse liberty linux 9 to version 2.0.3-12.el9_8.3 or later.
- Update suse suse linux enterprise desktop 15 sp7 to version 2.0.3-150000.3.6.1 or later.
- Update suse suse linux enterprise module for basesystem 15 sp7 to version 2.0.3-150000.3.6.1 or later.
- Update suse suse linux enterprise server 15 sp7 to version 2.0.3-150000.3.6.1 or later.
- Update suse suse linux enterprise server for sap applications 15 sp7 to version 2.0.3-150000.3.6.1 or later.
- Update suse suse linux enterprise high performance computing 15 sp4-espos to version 2.0.3-150000.3.6.1 or later.
- Update suse suse linux enterprise high performance computing 15 sp4-ltss to version 2.0.3-150000.3.6.1 or later.
- Update suse suse linux enterprise high performance computing 15 sp5-espos to version 2.0.3-150000.3.6.1 or later.
- Update suse suse linux enterprise high performance computing 15 sp5-ltss to version 2.0.3-150000.3.6.1 or later.
- Update suse suse linux enterprise server 12 sp5-ltss to version 2.0.3-3.6.1 or later.
- Update suse suse linux enterprise server 15 sp4-ltss to version 2.0.3-150000.3.6.1 or later.
- Update suse suse linux enterprise server 15 sp5-ltss to version 2.0.3-150000.3.6.1 or later.
- Update suse suse linux enterprise server 15 sp6-ltss to version 2.0.3-150000.3.6.1 or later.
- Update suse suse linux enterprise server 16.0 to version 2.0.7-160000.5.1 or later.
- Update suse suse linux enterprise server for sap applications 16.0 to version 2.0.7-160000.5.1 or later.
- Update suse suse linux enterprise server ltss extended security 12 sp5 to version 2.0.3-3.6.1 or later.
- Update suse suse linux enterprise server for sap applications 15 sp4 to version 2.0.3-150000.3.6.1 or later.
- Update suse suse linux enterprise server for sap applications 15 sp5 to version 2.0.3-150000.3.6.1 or later.
- Update suse suse linux enterprise server for sap applications 15 sp6 to version 2.0.3-150000.3.6.1 or later.
- Update suse suse manager proxy lts 4.3 to version 2.0.3-150000.3.6.1 or later.
- Update suse suse manager retail branch server lts 4.3 to version 2.0.3-150000.3.6.1 or later.
- Update suse suse manager server lts 4.3 to version 2.0.3-150000.3.6.1 or later.
- Update suse opensuse leap 16.0 to version 2.0.7-160000.5.1 or later.
- Update suse opensuse tumbleweed to version 2.0.7-3.1 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:11 | debian | libxfont | All versions |
| Debian:12 | debian | libxfont | All versions |
| Debian:13 | debian | libxfont | All versions |
| Debian:14 | debian | libxfont |
< 1:2.0.9-1 Fix: upgrade to 1:2.0.9-1
|
| – | suse | container suse/kiosk/tigervnc-x11vnc:1.14-63.8 | < 2.0.3-150000.3.6.1 |
| – | suse | container suse/kiosk/xorg:21.1-83.7 | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp6-sap | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp6-sap-azure | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp6-sap-azure-3p | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp6-sap-byos | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp6-sap-byos-azure | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp6-sap-byos-ec2 | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp6-sap-byos-gce | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp6-sap-ec2 | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp6-sap-gce | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp6-sap-hardened | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp6-sap-hardened-azure | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp6-sap-hardened-byos | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp6-sap-hardened-byos-azure | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp6-sap-hardened-byos-ec2 | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp6-sap-hardened-byos-gce | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp6-sap-hardened-ec2 | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp6-sap-hardened-gce | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp6-sapcal | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp6-sapcal-azure | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp6-sapcal-ec2 | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp6-sapcal-gce | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp7-sap-azure | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp7-sap-azure-3p | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp7-sap-byos-azure | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp7-sap-byos-ec2 | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp7-sap-byos-gce | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp7-sap-ec2 | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp7-sap-gce | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp7-sap-gce-3p | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp7-sap-hardened-azure | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp7-sap-hardened-byos-azure | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp7-sap-hardened-byos-ec2 | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp7-sap-hardened-byos-gce | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp7-sap-hardened-gce | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp7-sapcal-azure | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp7-sapcal-ec2 | < 2.0.3-150000.3.6.1 |
| – | suse | image sles15-sp7-sapcal-gce | < 2.0.3-150000.3.6.1 |
| – | suse | image sles-sap-azure | < 2.0.7-160000.5.1 |
| – | suse | image sles-sap-azure-3p | < 2.0.7-160000.5.1 |
| – | suse | image sles-sap-byos-azure | < 2.0.7-160000.5.1 |
| – | suse | image sles-sap-byos-ec2 | < 2.0.7-160000.5.1 |
| – | suse | image sles-sap-byos-gce | < 2.0.7-160000.5.1 |
| – | suse | image sles-sap-gce | < 2.0.7-160000.5.1 |
| – | suse | image sles-sap-gce-3p | < 2.0.7-160000.5.1 |
Showing 50 of 86. Show the rest
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | suse | image sles-sapcal-gce | < 2.0.7-160000.5.1 |
| – | suse | image sles12-sp5-azure-sap-byos | < 2.0.3-3.6.1 |
| – | suse | image sles12-sp5-azure-sap-on-demand | < 2.0.3-3.6.1 |
| – | suse | image sles12-sp5-ec2-sap-byos | < 2.0.3-3.6.1 |
| – | suse | image sles12-sp5-ec2-sap-on-demand | < 2.0.3-3.6.1 |
| – | suse | image sles12-sp5-gce-sap-byos | < 2.0.3-3.6.1 |
| – | suse | image sles12-sp5-gce-sap-on-demand | < 2.0.3-3.6.1 |
| – | suse | suse liberty linux 10 | < 2.0.6-5.el10_2.3 |
| – | suse | suse liberty linux 8 | < 2.0.3-2.el8_10.3 |
| – | suse | suse liberty linux 9 | < 2.0.3-12.el9_8.3 |
| – | suse | suse linux enterprise desktop 15 sp7 | < 2.0.3-150000.3.6.1 |
| – | suse | suse linux enterprise module for basesystem 15 sp7 | < 2.0.3-150000.3.6.1 |
| – | suse | suse linux enterprise server 15 sp7 | < 2.0.3-150000.3.6.1 |
| – | suse | suse linux enterprise server for sap applications 15 sp7 | < 2.0.3-150000.3.6.1 |
| – | suse | suse linux enterprise high performance computing 15 sp4-espos | < 2.0.3-150000.3.6.1 |
| – | suse | suse linux enterprise high performance computing 15 sp4-ltss | < 2.0.3-150000.3.6.1 |
| – | suse | suse linux enterprise high performance computing 15 sp5-espos | < 2.0.3-150000.3.6.1 |
| – | suse | suse linux enterprise high performance computing 15 sp5-ltss | < 2.0.3-150000.3.6.1 |
| – | suse | suse linux enterprise server 12 sp5-ltss | < 2.0.3-3.6.1 |
| – | suse | suse linux enterprise server 15 sp4-ltss | < 2.0.3-150000.3.6.1 |
| – | suse | suse linux enterprise server 15 sp5-ltss | < 2.0.3-150000.3.6.1 |
| – | suse | suse linux enterprise server 15 sp6-ltss | < 2.0.3-150000.3.6.1 |
| – | suse | suse linux enterprise server 16.0 | < 2.0.7-160000.5.1 |
| – | suse | suse linux enterprise server for sap applications 16.0 | < 2.0.7-160000.5.1 |
| – | suse | suse linux enterprise server ltss extended security 12 sp5 | < 2.0.3-3.6.1 |
| – | suse | suse linux enterprise server for sap applications 15 sp4 | < 2.0.3-150000.3.6.1 |
| – | suse | suse linux enterprise server for sap applications 15 sp5 | < 2.0.3-150000.3.6.1 |
| – | suse | suse linux enterprise server for sap applications 15 sp6 | < 2.0.3-150000.3.6.1 |
| – | suse | suse manager proxy lts 4.3 | < 2.0.3-150000.3.6.1 |
| – | suse | suse manager retail branch server lts 4.3 | < 2.0.3-150000.3.6.1 |
| – | suse | suse manager server lts 4.3 | < 2.0.3-150000.3.6.1 |
| – | suse | opensuse leap 16.0 | < 2.0.7-160000.5.1 |
| – | suse | opensuse tumbleweed | < 2.0.7-3.1 |
| – | libxfont2 | libxfont2 | <= 2.0.8 |
| Ubuntu:Pro:14.04:LTS | canonical | libxfont | All versions |
| Ubuntu:16.04:LTS | canonical | libxfont2 | All versions |
Original advisory text
fs_read_glyphs() heap OOB read/write via encoding array index mismatch in libXfont2
fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a size derived from num_extents in the separate FS_QueryXExtents16 reply. The two CARD32 fields are never cross-checked. A malicious or compromised font server can send a small num_extents (e.g. 1) in the extents reply, then a large num_chars (e.g. 100000) in the bitmaps reply. This causes attacker-controlled out-of-bounds heap read and writes.
References
- https://security-tracker.debian.org/tracker/CVE-2026-59679 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-59679 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-59679 Third Party Advisory
- https://www.openwall.com/lists/oss-security/2026/08/05/1 Third Party Advisory
- https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-59679
Severity
9.4
Critical
Exploitation
EPSS <1%
Type
CWE-787Out-of-bounds Write
Timeline
Published10 Sep 2026
Updated19 Sep 2026
First seen10 Aug 2026
Sources
DEBIAN-CVE-2026-59679 · OSV
CVE-2026-59679 · NVD
CVE-2026-59679 · MITRE
UBUNTU-CVE-2026-59679 · OSV
Track software like this
Free during beta