CVE-2026-56002

HIGH 8.5

libXfont2 PCF Font Parsing Heap Buffer Overflow

CVSS Score

8.5

EPSS Score

0.5%

EPSS Percentile

41th

A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8 allows attackers authenticated as X client to execute code within the X server.

CWE	CWE-122
Vendor	x.org
Product	libxfont2
Published	Jul 8, 2026
Last Updated	Jul 9, 2026

Stay Ahead of the Next One

Get instant alerts for x.org libxfont2

Be the first to know when new high vulnerabilities affecting x.org libxfont2 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

X.Org / libXfont2

0 < 2.0.8

References

NVD ↗ CVE.org ↗ EPSS Data ↗

gitlab.freedesktop.org: https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit/b4389e0b1d84a690b819bb27b1439968811a3674 openwall.com: https://www.openwall.com/lists/oss-security/2026/07/08/1

Credits

Anonymous working with Trend Micro Zero Day Initiative.