CVE-2026-44950

libXfont2's font-server client code, fs_read_glyphs() in src/fc/fserve.c, copies each glyph's bitmap into a single destination heap buffer, but its validation only checks that each source (position, length) slice lies within the source bitmap — it never checks whether the running destination write cursor has exceeded the allocation. A malicious or compromised font server can trigger this by sending many glyphs with overlapping source offsets (e.g., 1000 glyphs each with position 0, length 64, and nbytes=64): every individual source range passes validation, yet cumulative writes total 64,000 bytes into a 64-byte buffer, with attacker-controlled content. The result is a network-triggered heap buffer overflow (CVSS 4.0: 9.5, critical, with high impact on confidentiality, integrity and availability) that can at minimum crash the connecting X server and may enable code execution given the controlled overflow data. Affected are X servers and other font clients built against libXfont2 and configured to fetch fonts from an X font server (xfs, over TCP or a local socket); systems whose font path uses only locally installed files rarely exercise the vulnerable code path. There is currently no known exploitation, no public proof-of-concept, and the issue is not listed in CISA KEV.

What to do: Upgrade libXfont2 to a patched release as soon as one becomes available (the source data does not specify a fixed version number). In the meantime, check whether your X server's FontPath contains font-server entries (e.g., tcp/hostname:7100, unix/:7100, or catalogue-based xfs configurations) — if so, remove them and rely on locally installed fonts via fontconfig/freetype, and treat any font server your clients do connect to as untrusted until patched.