CVE-2026-59679

libXfont2, the X.Org library that X servers use to fetch fonts from a remote font server, contains a heap out-of-bounds read and write in fs_read_glyphs() in src/fc/fserve.c. The function allocates its per-character encoding[] array sized from num_extents in the FS_QueryXExtents16 reply, but indexes it using num_chars from the later FS_QueryXBitmaps16 reply, and the two CARD32 counts are never cross-checked. A malicious or compromised font server can send a small num_extents (e.g. 1) followed by a large num_chars (e.g. 100000), yielding attacker-controlled out-of-bounds heap reads and writes that can crash the X server, corrupt memory, or disclose memory contents. Only systems whose X servers actually use a font server in their font path (fs:/tcp-style entries) are affected; X servers using only local font directories do not exercise the vulnerable code, making this mainly a risk for legacy thin-client, terminal, and similar deployments. There is currently no known public proof-of-concept, no CISA KEV listing, and no reported in-the-wild exploitation.

What to do: Upgrade libXfont2 to the fixed release once published by X.Org or your distribution (the fixed version is not yet specified in the available data). As an interim mitigation, remove any font server entries (fs:, tcp:, unix:) from the X server's font path and rely on local font directories, or restrict which hosts can act as the font server. Check your FontPath with 'xset q' or the X server log to determine whether any X server on your estate actually connects to a font server and is therefore exposed.