CVE-2026-44950 — fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow in libXfont2

Description

fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice (position, length) lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the allocation.

A malicious font server can send overlapping source offsets -- for example 1000 glyphs each referencing {position:0, length:64} with nbytes=64. Each individual source range passes the existing validation, but the cumulative writes total 64000 bytes into a 64-byte destination buffer. This is a heap buffer overflow with attacker-controlled content.

Affected products

Vendor	Product	Affected	Fixed
SUSE	Container suse/kiosk/tigervnc-x11vnc:1.14-63.8	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Container suse/kiosk/xorg:21.1-83.7	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP6-SAP	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP6-SAP-Azure	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP6-SAP-Azure-3P	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP6-SAP-BYOS	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP6-SAP-BYOS-Azure	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP6-SAP-BYOS-EC2	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP6-SAP-BYOS-GCE	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP6-SAP-EC2	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP6-SAP-GCE	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP6-SAP-Hardened	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP6-SAP-Hardened-Azure	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP6-SAP-Hardened-BYOS	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP6-SAP-Hardened-BYOS-Azure	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP6-SAP-Hardened-BYOS-EC2	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP6-SAP-Hardened-BYOS-GCE	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP6-SAP-Hardened-EC2	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP6-SAP-Hardened-GCE	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP6-SAPCAL	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP6-SAPCAL-Azure	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP6-SAPCAL-EC2	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP6-SAPCAL-GCE	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP7-SAP-Azure	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP7-SAP-Azure-3P	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP7-SAP-BYOS-Azure	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP7-SAP-BYOS-EC2	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP7-SAP-BYOS-GCE	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP7-SAP-EC2	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP7-SAP-GCE	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP7-SAP-GCE-3P	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP7-SAP-Hardened-Azure	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP7-SAP-Hardened-BYOS-Azure	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP7-SAP-Hardened-BYOS-EC2	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP7-SAP-Hardened-BYOS-GCE	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP7-SAP-Hardened-GCE	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP7-SAPCAL-Azure	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP7-SAPCAL-EC2	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP7-SAPCAL-GCE	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES-SAP-Azure	? – < 2.0.7-160000.5.1	2.0.7-160000.5.1
SUSE	Image SLES-SAP-Azure-3P	? – < 2.0.7-160000.5.1	2.0.7-160000.5.1
SUSE	Image SLES-SAP-BYOS-Azure	? – < 2.0.7-160000.5.1	2.0.7-160000.5.1
SUSE	Image SLES-SAP-BYOS-EC2	? – < 2.0.7-160000.5.1	2.0.7-160000.5.1
SUSE	Image SLES-SAP-BYOS-GCE	? – < 2.0.7-160000.5.1	2.0.7-160000.5.1
SUSE	Image SLES-SAP-GCE	? – < 2.0.7-160000.5.1	2.0.7-160000.5.1
SUSE	Image SLES-SAP-GCE-3P	? – < 2.0.7-160000.5.1	2.0.7-160000.5.1
SUSE	Image SLES-SAPCAL-GCE	? – < 2.0.7-160000.5.1	2.0.7-160000.5.1
SUSE	Image SLES12-SP5-Azure-SAP-BYOS	? – < 2.0.3-3.6.1	2.0.3-3.6.1
SUSE	Image SLES12-SP5-Azure-SAP-On-Demand	? – < 2.0.3-3.6.1	2.0.3-3.6.1
SUSE	Image SLES12-SP5-EC2-SAP-BYOS	? – < 2.0.3-3.6.1	2.0.3-3.6.1
SUSE	Image SLES12-SP5-EC2-SAP-On-Demand	? – < 2.0.3-3.6.1	2.0.3-3.6.1
SUSE	Image SLES12-SP5-GCE-SAP-BYOS	? – < 2.0.3-3.6.1	2.0.3-3.6.1
SUSE	Image SLES12-SP5-GCE-SAP-On-Demand	? – < 2.0.3-3.6.1	2.0.3-3.6.1
SUSE	SUSE Liberty Linux 10	? – < 2.0.6-5.el10_2.3	2.0.6-5.el10_2.3
SUSE	SUSE Liberty Linux 8	? – < 2.0.3-2.el8_10.3	2.0.3-2.el8_10.3
SUSE	SUSE Liberty Linux 9	? – < 2.0.3-12.el9_8.3	2.0.3-12.el9_8.3
SUSE	SUSE Linux Enterprise Desktop 15 SP7	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	SUSE Linux Enterprise Module for Basesystem 15 SP7	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	SUSE Linux Enterprise Server 15 SP7	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	SUSE Linux Enterprise Server for SAP Applications 15 SP7	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	SUSE Linux Enterprise Server 12 SP5-LTSS	? – < 2.0.3-3.6.1	2.0.3-3.6.1
SUSE	SUSE Linux Enterprise Server 15 SP4-LTSS	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	SUSE Linux Enterprise Server 15 SP5-LTSS	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	SUSE Linux Enterprise Server 15 SP6-LTSS	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	SUSE Linux Enterprise Server 16.0	? – < 2.0.7-160000.5.1	2.0.7-160000.5.1
SUSE	SUSE Linux Enterprise Server for SAP applications 16.0	? – < 2.0.7-160000.5.1	2.0.7-160000.5.1
SUSE	SUSE Linux Enterprise Server LTSS Extended Security 12 SP5	? – < 2.0.3-3.6.1	2.0.3-3.6.1
SUSE	SUSE Linux Enterprise Server for SAP Applications 15 SP4	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	SUSE Linux Enterprise Server for SAP Applications 15 SP5	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	SUSE Linux Enterprise Server for SAP Applications 15 SP6	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	SUSE Manager Proxy LTS 4.3	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	SUSE Manager Retail Branch Server LTS 4.3	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	SUSE Manager Server LTS 4.3	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	openSUSE Leap 16.0	? – < 2.0.7-160000.5.1	2.0.7-160000.5.1
SUSE	openSUSE Tumbleweed	? – < 2.0.7-3.1	2.0.7-3.1
libXfont	libXfont	? – ≤ 2.0.8	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	libxfont	1:2.0.9-1	—
Debian 13	libxfont	No fix yet	—
Debian 12	libxfont	No fix yet	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 16.04 LTS	libxfont2	No fix yet	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 10	libXfont2 +1	2.0.6-5.el10_2.3	RHSA-2026:55448
RHEL 9	libXfont2 +1	2.0.3-12.el9_8.3	RHSA-2026:55447
RHEL 8	libXfont2 +1	2.0.3-2.el8_10.3	RHSA-2026:55446

Show 11 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
RHEL 10.0 EUS	libXfont2 +1	2.0.6-5.el10_0.2	RHSA-2026:62123
RHEL 9.6 EUS	libXfont2 +1	2.0.3-12.el9_6.3	RHSA-2026:61390
RHEL 9.4 E4S	libXfont2	2.0.3-12.el9_4.3	RHSA-2026:59312
RHEL 9.2 E4S	libXfont2	2.0.3-12.el9_2.3	RHSA-2026:59311
RHEL 8.8 TUS	libXfont2	2.0.3-2.el8_8.2	RHSA-2026:61756
RHEL 8.8 E4S	libXfont2	2.0.3-2.el8_8.2	RHSA-2026:61756
RHEL 8.6 EUS Long Life	libXfont2	2.0.3-2.el8_6.2	RHSA-2026:61755
RHEL 8.6 AUS	libXfont2	2.0.3-2.el8_6.2	RHSA-2026:61755
RHEL 8.4 EUS Long Life	libXfont2	2.0.3-2.el8_4.2	RHSA-2026:61995
RHEL 8.4 AUS	libXfont2	2.0.3-2.el8_4.2	RHSA-2026:61995
RHEL 7 ELS	libXfont2 +1	2.0.3-3.el7_9	RHSA-2026:62231

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 10	libXfont2 +1	2.0.6-5.el10_2.3	ALSA-2026:55448
AlmaLinux 9	libXfont2 +1	2.0.3-12.el9_8.3	ALSA-2026:55447
AlmaLinux 8	libXfont2 +1	2.0.3-2.el8_10.3	ALSA-2026:55446

Rocky Linux

Errata ↗

Release	Package	Fixed in	Advisory
Rocky Linux 10	libXfont2	2.0.6-5.el10_2.3	RLSA-2026:55448
Rocky Linux 9	libXfont2	2.0.3-12.el9_8.3	RLSA-2026:55447
Rocky Linux 8	libXfont2	2.0.3-2.el8_10.3	RLSA-2026:55446

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP7	libXfont2	2.0.3-150000.3.6.1	SUSE-SU-2026:3500-1
SLES 15 SP6	libXfont2	2.0.3-150000.3.6.1	SUSE-SU-2026:3500-1
SLES 15 SP5	libXfont2	2.0.3-150000.3.6.1	SUSE-SU-2026:3500-1
SLES 15 SP4	libXfont2	2.0.3-150000.3.6.1	SUSE-SU-2026:3500-1
SLES 12 SP5	libXfont2	2.0.3-3.6.1	SUSE-SU-2026:3499-1

Show 7 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES for SAP 16.0	libXfont2	2.0.7-160000.5.1	SUSE-SU-2026:23151-1, SUSE-SU-2026:23128-1
SLES for SAP 15 SP6	libXfont2	2.0.3-150000.3.6.1	SUSE-SU-2026:3500-1
SLES for SAP 15 SP5	libXfont2	2.0.3-150000.3.6.1	SUSE-SU-2026:3500-1
SLES for SAP 15 SP4	libXfont2	2.0.3-150000.3.6.1	SUSE-SU-2026:3500-1
SLES 16.0	libXfont2	2.0.7-160000.5.1	SUSE-SU-2026:23151-1, SUSE-SU-2026:23128-1
SLE HPC 15 SP5	libXfont2	2.0.3-150000.3.6.1	SUSE-SU-2026:3500-1
SLE HPC 15 SP4	libXfont2	2.0.3-150000.3.6.1	SUSE-SU-2026:3500-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	libXfont2	2.0.7-3.1	openSUSE-SU-2026:11463-1
openSUSE Leap 16.0	libXfont2	2.0.7-160000.5.1	openSUSE-SU-2026:21539-1

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2023	libXfont2 +1	2.0.7-1.amzn2023.0.3	ALAS2023-2026-2112
Amazon Linux 2	libXfont +1	1.5.4-1.amzn2.0.2	ALAS2-2026-3890
Amazon Linux 2	libXfont2 +1	2.0.3-1.amzn2.0.2	ALAS2-2026-3889

Azure Linux

Release	Package	Fixed in	Advisory
Azure Linux 3	libXfont2	2.0.9-1	—

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 10	libXfont2 +1	2.0.6-5.el10_2.3	ELSA-2026-55448
Oracle Linux 9	libXfont2 +1	2.0.3-12.el9_8.3	ELSA-2026-55447
Oracle Linux 8	libXfont2 +1	2.0.3-2.el8_10.3	ELSA-2026-55446

Advisories 30

ALSA-2026:55447 Important: libXfont2 security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:55448 Important: libXfont2 security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:55446 Important: libXfont2 security update AlmaLinux Security Advisories · Oct 29, 2026
RHSA-2026:62123 Red Hat Security Advisory: libXfont2 security update Red Hat Security Advisories (RHSA) · Oct 7, 2026
RHSA-2026:62231 Red Hat Security Advisory: libXfont2 security update Red Hat Security Advisories (RHSA) · Oct 7, 2026
RHSA-2026:61995 Red Hat Security Advisory: libXfont2 security update Red Hat Security Advisories (RHSA) · Oct 7, 2026
RHSA-2026:61756 Red Hat Security Advisory: libXfont2 security update Red Hat Security Advisories (RHSA) · Oct 7, 2026
RHSA-2026:61755 Red Hat Security Advisory: libXfont2 security update Red Hat Security Advisories (RHSA) · Oct 7, 2026
RHSA-2026:61390 Red Hat Security Advisory: libXfont2 security update Red Hat Security Advisories (RHSA) · Oct 7, 2026
RHSA-2026:59312 Red Hat Security Advisory: libXfont2 security update Red Hat Security Advisories (RHSA) · Oct 7, 2026
RHSA-2026:59311 Red Hat Security Advisory: libXfont2 security update Red Hat Security Advisories (RHSA) · Oct 7, 2026
RHSA-2026:55447 Red Hat Security Advisory: libXfont2 security update Red Hat Security Advisories (RHSA) · Oct 7, 2026
RHSA-2026:55448 Red Hat Security Advisory: libXfont2 security update Red Hat Security Advisories (RHSA) · Oct 7, 2026
RHSA-2026:55446 Red Hat Security Advisory: libXfont2 security update Red Hat Security Advisories (RHSA) · Oct 7, 2026
WID-SEC-2026-2658 X.Org X11 (libXfont2): Mehrere Schwachstellen ermöglichen Privilegieneskalation und Denial of Service BSI CERT-Bund (WID) · Sep 29, 2026
ALAS2-2026-3889 Important: libXfont2 security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Aug 31, 2026
ALAS2-2026-3890 Important: libXfont security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Aug 31, 2026
ALAS2023-2026-2112 Important: libXfont2 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Aug 31, 2026
RLSA-2026:55446 Important: libXfont2 security update Rocky Linux Security Advisories · Aug 17, 2026
RLSA-2026:55447 Important: libXfont2 security update Rocky Linux Security Advisories · Aug 17, 2026
RLSA-2026:55448 Important: libXfont2 security update Rocky Linux Security Advisories · Aug 17, 2026
ELSA-2026-55448 Important: libXfont2 security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Aug 17, 2026
ELSA-2026-55447 Important: libXfont2 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Aug 17, 2026
ELSA-2026-55446 Important: libXfont2 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Aug 17, 2026
SUSE-SU-2026:23151-1 Security update for libXfont2 SUSE / openSUSE Security Updates · Aug 14, 2026
SUSE-SU-2026:23128-1 Security update for libXfont2 SUSE / openSUSE Security Updates · Aug 14, 2026
openSUSE-SU-2026:21539-1 Security update for libXfont2 SUSE / openSUSE Security Updates · Aug 8, 2026
openSUSE-SU-2026:11463-1 libXfont2-2-2.0.7-3.1 on GA media SUSE / openSUSE Security Updates · Aug 7, 2026
SUSE-SU-2026:3499-1 Security update for libXfont2 SUSE / openSUSE Security Updates · Aug 6, 2026
SUSE-SU-2026:3500-1 Security update for libXfont2 SUSE / openSUSE Security Updates · Aug 6, 2026

References

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44950

CNA	v4.0	9.5
CNA	v3.1	9.0
EUVD	v4.0	9.5