Skip to content
OpenAdvisories
High ALSA-2026:47084 3 CVEs

Important: libXfont2 security update

Published Jul 28, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

X.Org X11 libXfont2 runtime library

Security Fix(es):

* libXfont2: BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow (CVE-2026-56001)
* libXfont2: PCF Font Parsing Heap Buffer Overflow (CVE-2026-56002)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 2

ReleasePackageFixed in
AlmaLinux · 9 libXfont2 2.0.3-12.el9_8.1
AlmaLinux · 9 libXfont2-devel 2.0.3-12.el9_8.1

Vulnerabilities 3

  • High 8.5
    CVE-2026-56001

    libXfont2 BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow

    A heap buffer overflow in BitmapScaleBitmaps in libXfont2 before 2.0.8 due to an overflowing 32bit size could be used by attackers able to access the X Server to execute code within the X server cont

    X.Org libXfont2 libxfont libxfont Debian Ubuntu Azure Linux Alpine
  • High 8.5
    CVE-2026-56002

    libXfont2 PCF Font Parsing Heap Buffer Overflow

    A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8  allows attackers authenticated as X client to execute code within the X server.

    X.Org libXfont2 libxfont libxfont Debian Ubuntu Azure Linux Alpine
  • High 8.5
    CVE-2026-56003

    libXfont2 computeProps Property Buffer Heap Buffer Overflow

    A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2 ComputeScaledProperties() before libXfont2 before 2.0.8 could be used by attackers using authenticated X clients to execute code within the X server.

    X.Org libXfont2 libxfont libxfont Debian Ubuntu Azure Linux Alpine

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-56001
  • report
    https://access.redhat.com/security/cve/CVE-2026-56002
  • report
    https://bugzilla.redhat.com/2496640
  • report
    https://bugzilla.redhat.com/2496641
  • advisory
    https://errata.almalinux.org/9/ALSA-2026-47084.html
  • report
    https://www.redhat.com/security/data/cve/CVE-2026-56003.html