CVE-2026-56003 — libXfont2 computeProps Property Buffer Heap Buffer Overflow

Description

A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2 ComputeScaledProperties() before libXfont2 before 2.0.8 could be used by attackers using authenticated X clients to execute code within the X server.

Affected products

Vendor	Product	Affected	Fixed
X.Org	libXfont2	< 2.0.8	2.0.8

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	libxfont	1:2.0.8-1	—
Debian 13	libxfont	1:2.0.6-1+deb13u1	—
Debian 12	libxfont	1:2.0.6-1+deb12u1	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 26.04 LTS	libxfont	1:2.0.6-2ubuntu0.2	USN-8560-1
Ubuntu 25.10	libxfont	No fix yet	—
Ubuntu 24.04 LTS	libxfont	1:2.0.6-1+deb13u1build0.24.04.2	USN-8560-1
Ubuntu 22.04 LTS	libxfont	1:2.0.5-1ubuntu0.2	USN-8560-1
Ubuntu 16.04 LTS	libxfont2	No fix yet	—

Show 4 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 20.04 LTS	libxfont	1:2.0.3-1ubuntu0.20.04.1~esm2	USN-8560-1
Ubuntu Pro 18.04 LTS	libxfont	1:2.0.3-1ubuntu0.1~esm2	USN-8560-1
Ubuntu Pro 16.04 LTS	libxfont	1:1.5.1-1ubuntu0.16.04.4+esm2	USN-8560-1
Ubuntu Pro 14.04 LTS	libxfont	1:1.4.7-1ubuntu0.4+esm2	USN-8560-1

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 10	libXfont2 +1	2.0.6-5.el10_2.1	RHSA-2026:47079
RHEL 9	libXfont2 +1	2.0.3-12.el9_8.1	RHSA-2026:47084
RHEL 8	libXfont2 +1	2.0.3-2.el8_10.1	RHSA-2026:47103

Show 11 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
RHEL 10.0 EUS	libXfont2 +1	2.0.6-5.el10_0.1	RHSA-2026:51061
RHEL 9.6 EUS	libXfont2 +1	2.0.3-12.el9_6.1	RHSA-2026:51059
RHEL 9.4 E4S	libXfont2	2.0.3-12.el9_4.1	RHSA-2026:51058
RHEL 9.2 E4S	libXfont2	2.0.3-12.el9_2.1	RHSA-2026:51062
RHEL 8.8 TUS	libXfont2	2.0.3-2.el8_8.1	RHSA-2026:51067
RHEL 8.8 E4S	libXfont2	2.0.3-2.el8_8.1	RHSA-2026:51067
RHEL 8.6 EUS Long Life	libXfont2	2.0.3-2.el8_6.1	RHSA-2026:51066
RHEL 8.6 AUS	libXfont2	2.0.3-2.el8_6.1	RHSA-2026:51066
RHEL 8.4 EUS Long Life	libXfont2	2.0.3-2.el8_4.1	RHSA-2026:51060
RHEL 8.4 AUS	libXfont2	2.0.3-2.el8_4.1	RHSA-2026:51060
RHEL 7 ELS	libXfont2 +1	2.0.3-2.el7_9	RHSA-2026:51063

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 10	libXfont2 +1	2.0.6-5.el10_2.1	ALSA-2026:47079
AlmaLinux 9	libXfont2 +1	2.0.3-12.el9_8.1	ALSA-2026:47084
AlmaLinux 8	libXfont2 +1	2.0.3-2.el8_10.1	ALSA-2026:47103

Rocky Linux

Errata ↗

Release	Package	Fixed in	Advisory
Rocky Linux 8	libXfont2	2.0.3-2.el8_10.1	RLSA-2026:47103

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP7	libXfont2	2.0.3-150000.3.3.1	SUSE-SU-2026:2794-1
SLES 15 SP6	libXfont2	2.0.3-150000.3.3.1	SUSE-SU-2026:2794-1
SLES 15 SP5	libXfont2	2.0.3-150000.3.3.1	SUSE-SU-2026:2794-1
SLES 15 SP4	libXfont2	2.0.3-150000.3.3.1	SUSE-SU-2026:2794-1
SLES 12 SP5	libXfont2	2.0.3-3.3.1	SUSE-SU-2026:2793-1

Show 7 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES for SAP 16.0	libXfont2	2.0.7-160000.4.1	SUSE-SU-2026:22614-1
SLES for SAP 15 SP6	libXfont2	2.0.3-150000.3.3.1	SUSE-SU-2026:2794-1
SLES for SAP 15 SP5	libXfont2	2.0.3-150000.3.3.1	SUSE-SU-2026:2794-1
SLES for SAP 15 SP4	libXfont2	2.0.3-150000.3.3.1	SUSE-SU-2026:2794-1
SLES 16.0	libXfont2	2.0.7-160000.4.1	SUSE-SU-2026:22614-1
SLE HPC 15 SP5	libXfont2	2.0.3-150000.3.3.1	SUSE-SU-2026:2794-1
SLE HPC 15 SP4	libXfont2	2.0.3-150000.3.3.1	SUSE-SU-2026:2794-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	libXfont2	2.0.7-2.1	openSUSE-SU-2026:11233-1
openSUSE Leap 16.0	libXfont2	2.0.7-160000.4.1	openSUSE-SU-2026:21284-1

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.24	libxfont2	2.0.8-r0	—

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2023	libXfont2 +1	2.0.7-1.amzn2023.0.2	ALAS2023-2026-1967
Amazon Linux 2	libXfont +1	1.5.4-1.amzn2.0.1	ALAS2-2026-3815
Amazon Linux 2	libXfont2 +1	2.0.3-1.amzn2.0.1	ALAS2-2026-3814

Azure Linux

Release	Package	Fixed in	Advisory
Azure Linux 3	libXfont2	2.0.8-1	—

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 8	libXfont2 +1	2.0.3-2.el8_10.1	ELSA-2026-47103
Oracle Linux 7	libXfont2 +1	2.0.3-1.0.1.el7	ELSA-2026-51063

Advisories 27

ALSA-2026:47084 Important: libXfont2 security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:47079 Important: libXfont2 security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:47103 Important: libXfont2 security update AlmaLinux Security Advisories · Oct 29, 2026
RHSA-2026:51059 Red Hat Security Advisory: libXfont2 security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
RHSA-2026:51060 Red Hat Security Advisory: libXfont2 security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
RHSA-2026:51061 Red Hat Security Advisory: libXfont2 security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
RHSA-2026:51062 Red Hat Security Advisory: libXfont2 security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
RHSA-2026:47084 Red Hat Security Advisory: libXfont2 security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
RHSA-2026:51067 Red Hat Security Advisory: libXfont2 security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
RHSA-2026:51058 Red Hat Security Advisory: libXfont2 security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
RHSA-2026:47103 Red Hat Security Advisory: libXfont2 security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
RHSA-2026:47079 Red Hat Security Advisory: libXfont2 security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
RHSA-2026:51063 Red Hat Security Advisory: libXfont2 security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
RHSA-2026:51066 Red Hat Security Advisory: libXfont2 security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
WID-SEC-2026-2378 X.Org X11 Server (libXfont2): Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode mit Administratorrechten BSI CERT-Bund (WID) · Sep 29, 2026
ELSA-2026-51063 Important: libXfont2 security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 12, 2026
RLSA-2026:47103 Important: libXfont2 security update Rocky Linux Security Advisories · Jul 29, 2026
ELSA-2026-47103 Important: libXfont2 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jul 28, 2026
USN-8560-1 libxfont vulnerabilities Ubuntu Security Notices (USN) · Jul 21, 2026
ALAS2-2026-3814 Important: libXfont2 security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jul 20, 2026
ALAS2-2026-3815 Important: libXfont security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jul 20, 2026
ALAS2023-2026-1967 Important: libXfont2 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jul 20, 2026
SUSE-SU-2026:22614-1 Security update for libXfont2 SUSE / openSUSE Security Updates · Jul 17, 2026
openSUSE-SU-2026:21284-1 Security update for libXfont2 SUSE / openSUSE Security Updates · Jul 13, 2026
openSUSE-SU-2026:11233-1 libXfont2-2-2.0.7-2.1 on GA media SUSE / openSUSE Security Updates · Jul 10, 2026
SUSE-SU-2026:2793-1 Security update for libXfont2 SUSE / openSUSE Security Updates · Jul 9, 2026
SUSE-SU-2026:2794-1 Security update for libXfont2 SUSE / openSUSE Security Updates · Jul 9, 2026

CNA	v3.1	8.5
EUVD	v3.1	8.5

libXfont2 computeProps Property Buffer Heap Buffer Overflow

Description

Affected products

Fixed in Linux distributions

Debian

Ubuntu

Red Hat

AlmaLinux

Rocky Linux

SUSE

openSUSE

Alpine

Amazon Linux

Azure Linux

Oracle Linux

Advisories 27

References