CVE-2026-59679 — fs_read_glyphs() heap OOB read/write via encoding array index mismatch in libXfont2

Description

fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a size derived from num_extents in the separate FS_QueryXExtents16 reply. The two CARD32 fields are never cross-checked.
A malicious or compromised font server can send a small num_extents (e.g. 1) in the extents reply, then a large num_chars (e.g. 100000) in the bitmaps reply. This causes attacker-controlled out-of-bounds heap read and writes.

Affected products

Vendor	Product	Affected	Fixed
SUSE	Container suse/kiosk/tigervnc-x11vnc:1.14-63.8	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Container suse/kiosk/xorg:21.1-83.7	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP6-SAP	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP6-SAP-Azure	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP6-SAP-Azure-3P	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP6-SAP-BYOS	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP6-SAP-BYOS-Azure	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP6-SAP-BYOS-EC2	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP6-SAP-BYOS-GCE	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP6-SAP-EC2	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP6-SAP-GCE	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP6-SAP-Hardened	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP6-SAP-Hardened-Azure	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP6-SAP-Hardened-BYOS	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP6-SAP-Hardened-BYOS-Azure	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP6-SAP-Hardened-BYOS-EC2	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP6-SAP-Hardened-BYOS-GCE	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP6-SAP-Hardened-EC2	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP6-SAP-Hardened-GCE	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP6-SAPCAL	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP6-SAPCAL-Azure	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP6-SAPCAL-EC2	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP6-SAPCAL-GCE	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP7-SAP-Azure	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP7-SAP-Azure-3P	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP7-SAP-BYOS-Azure	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP7-SAP-BYOS-EC2	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP7-SAP-BYOS-GCE	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP7-SAP-EC2	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP7-SAP-GCE	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP7-SAP-GCE-3P	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP7-SAP-Hardened-Azure	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP7-SAP-Hardened-BYOS-Azure	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP7-SAP-Hardened-BYOS-EC2	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP7-SAP-Hardened-BYOS-GCE	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP7-SAP-Hardened-GCE	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP7-SAPCAL-Azure	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP7-SAPCAL-EC2	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES15-SP7-SAPCAL-GCE	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	Image SLES-SAP-Azure	? – < 2.0.7-160000.5.1	2.0.7-160000.5.1
SUSE	Image SLES-SAP-Azure-3P	? – < 2.0.7-160000.5.1	2.0.7-160000.5.1
SUSE	Image SLES-SAP-BYOS-Azure	? – < 2.0.7-160000.5.1	2.0.7-160000.5.1
SUSE	Image SLES-SAP-BYOS-EC2	? – < 2.0.7-160000.5.1	2.0.7-160000.5.1
SUSE	Image SLES-SAP-BYOS-GCE	? – < 2.0.7-160000.5.1	2.0.7-160000.5.1
SUSE	Image SLES-SAP-GCE	? – < 2.0.7-160000.5.1	2.0.7-160000.5.1
SUSE	Image SLES-SAP-GCE-3P	? – < 2.0.7-160000.5.1	2.0.7-160000.5.1
SUSE	Image SLES-SAPCAL-GCE	? – < 2.0.7-160000.5.1	2.0.7-160000.5.1
SUSE	Image SLES12-SP5-Azure-SAP-BYOS	? – < 2.0.3-3.6.1	2.0.3-3.6.1
SUSE	Image SLES12-SP5-Azure-SAP-On-Demand	? – < 2.0.3-3.6.1	2.0.3-3.6.1
SUSE	Image SLES12-SP5-EC2-SAP-BYOS	? – < 2.0.3-3.6.1	2.0.3-3.6.1
SUSE	Image SLES12-SP5-EC2-SAP-On-Demand	? – < 2.0.3-3.6.1	2.0.3-3.6.1
SUSE	Image SLES12-SP5-GCE-SAP-BYOS	? – < 2.0.3-3.6.1	2.0.3-3.6.1
SUSE	Image SLES12-SP5-GCE-SAP-On-Demand	? – < 2.0.3-3.6.1	2.0.3-3.6.1
SUSE	SUSE Liberty Linux 10	? – < 2.0.6-5.el10_2.3	2.0.6-5.el10_2.3
SUSE	SUSE Liberty Linux 8	? – < 2.0.3-2.el8_10.3	2.0.3-2.el8_10.3
SUSE	SUSE Liberty Linux 9	? – < 2.0.3-12.el9_8.3	2.0.3-12.el9_8.3
SUSE	SUSE Linux Enterprise Desktop 15 SP7	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	SUSE Linux Enterprise Module for Basesystem 15 SP7	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	SUSE Linux Enterprise Server 15 SP7	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	SUSE Linux Enterprise Server for SAP Applications 15 SP7	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	SUSE Linux Enterprise Server 12 SP5-LTSS	? – < 2.0.3-3.6.1	2.0.3-3.6.1
SUSE	SUSE Linux Enterprise Server 15 SP4-LTSS	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	SUSE Linux Enterprise Server 15 SP5-LTSS	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	SUSE Linux Enterprise Server 15 SP6-LTSS	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	SUSE Linux Enterprise Server 16.0	? – < 2.0.7-160000.5.1	2.0.7-160000.5.1
SUSE	SUSE Linux Enterprise Server for SAP applications 16.0	? – < 2.0.7-160000.5.1	2.0.7-160000.5.1
SUSE	SUSE Linux Enterprise Server LTSS Extended Security 12 SP5	? – < 2.0.3-3.6.1	2.0.3-3.6.1
SUSE	SUSE Linux Enterprise Server for SAP Applications 15 SP4	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	SUSE Linux Enterprise Server for SAP Applications 15 SP5	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	SUSE Linux Enterprise Server for SAP Applications 15 SP6	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	SUSE Manager Proxy LTS 4.3	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	SUSE Manager Retail Branch Server LTS 4.3	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	SUSE Manager Server LTS 4.3	? – < 2.0.3-150000.3.6.1	2.0.3-150000.3.6.1
SUSE	openSUSE Leap 16.0	? – < 2.0.7-160000.5.1	2.0.7-160000.5.1
SUSE	openSUSE Tumbleweed	? – < 2.0.7-3.1	2.0.7-3.1
libXfont2	libXfont2	? – ≤ 2.0.8	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	libxfont	1:2.0.9-1	—
Debian 13	libxfont	No fix yet	—
Debian 12	libxfont	No fix yet	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 16.04 LTS	libxfont2	No fix yet	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 10	libXfont2 +1	2.0.6-5.el10_2.3	RHSA-2026:55448
RHEL 9	libXfont2 +1	2.0.3-12.el9_8.3	RHSA-2026:55447
RHEL 8	libXfont2 +1	2.0.3-2.el8_10.3	RHSA-2026:55446

Show 11 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
RHEL 10.0 EUS	libXfont2 +1	2.0.6-5.el10_0.2	RHSA-2026:62123
RHEL 9.6 EUS	libXfont2 +1	2.0.3-12.el9_6.3	RHSA-2026:61390
RHEL 9.4 E4S	libXfont2	2.0.3-12.el9_4.3	RHSA-2026:59312
RHEL 9.2 E4S	libXfont2	2.0.3-12.el9_2.3	RHSA-2026:59311
RHEL 8.8 TUS	libXfont2	2.0.3-2.el8_8.2	RHSA-2026:61756
RHEL 8.8 E4S	libXfont2	2.0.3-2.el8_8.2	RHSA-2026:61756
RHEL 8.6 EUS Long Life	libXfont2	2.0.3-2.el8_6.2	RHSA-2026:61755
RHEL 8.6 AUS	libXfont2	2.0.3-2.el8_6.2	RHSA-2026:61755
RHEL 8.4 EUS Long Life	libXfont2	2.0.3-2.el8_4.2	RHSA-2026:61995
RHEL 8.4 AUS	libXfont2	2.0.3-2.el8_4.2	RHSA-2026:61995
RHEL 7 ELS	libXfont2 +1	2.0.3-3.el7_9	RHSA-2026:62231

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 10	libXfont2 +1	2.0.6-5.el10_2.3	ALSA-2026:55448
AlmaLinux 9	libXfont2 +1	2.0.3-12.el9_8.3	ALSA-2026:55447
AlmaLinux 8	libXfont2 +1	2.0.3-2.el8_10.3	ALSA-2026:55446

Rocky Linux

Errata ↗

Release	Package	Fixed in	Advisory
Rocky Linux 10	libXfont2	2.0.6-5.el10_2.3	RLSA-2026:55448
Rocky Linux 9	libXfont2	2.0.3-12.el9_8.3	RLSA-2026:55447
Rocky Linux 8	libXfont2	2.0.3-2.el8_10.3	RLSA-2026:55446

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP7	libXfont2	2.0.3-150000.3.6.1	SUSE-SU-2026:3500-1
SLES 15 SP6	libXfont2	2.0.3-150000.3.6.1	SUSE-SU-2026:3500-1
SLES 15 SP5	libXfont2	2.0.3-150000.3.6.1	SUSE-SU-2026:3500-1
SLES 15 SP4	libXfont2	2.0.3-150000.3.6.1	SUSE-SU-2026:3500-1
SLES 12 SP5	libXfont2	2.0.3-3.6.1	SUSE-SU-2026:3499-1

Show 7 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES for SAP 16.0	libXfont2	2.0.7-160000.5.1	SUSE-SU-2026:23151-1, SUSE-SU-2026:23128-1
SLES for SAP 15 SP6	libXfont2	2.0.3-150000.3.6.1	SUSE-SU-2026:3500-1
SLES for SAP 15 SP5	libXfont2	2.0.3-150000.3.6.1	SUSE-SU-2026:3500-1
SLES for SAP 15 SP4	libXfont2	2.0.3-150000.3.6.1	SUSE-SU-2026:3500-1
SLES 16.0	libXfont2	2.0.7-160000.5.1	SUSE-SU-2026:23151-1, SUSE-SU-2026:23128-1
SLE HPC 15 SP5	libXfont2	2.0.3-150000.3.6.1	SUSE-SU-2026:3500-1
SLE HPC 15 SP4	libXfont2	2.0.3-150000.3.6.1	SUSE-SU-2026:3500-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	libXfont2	2.0.7-3.1	openSUSE-SU-2026:11463-1
openSUSE Leap 16.0	libXfont2	2.0.7-160000.5.1	openSUSE-SU-2026:21539-1

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2023	libXfont2 +1	2.0.7-1.amzn2023.0.3	ALAS2023-2026-2112
Amazon Linux 2	libXfont +1	1.5.4-1.amzn2.0.2	ALAS2-2026-3890
Amazon Linux 2	libXfont2 +1	2.0.3-1.amzn2.0.2	ALAS2-2026-3889

Azure Linux

Release	Package	Fixed in	Advisory
Azure Linux 3	libXfont2	2.0.9-1	—

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 10	libXfont2 +1	2.0.6-5.el10_2.3	ELSA-2026-55448
Oracle Linux 9	libXfont2 +1	2.0.3-12.el9_8.3	ELSA-2026-55447
Oracle Linux 8	libXfont2 +1	2.0.3-2.el8_10.3	ELSA-2026-55446

Advisories 30

ALSA-2026:55447 Important: libXfont2 security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:55448 Important: libXfont2 security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:55446 Important: libXfont2 security update AlmaLinux Security Advisories · Oct 29, 2026
RHSA-2026:62123 Red Hat Security Advisory: libXfont2 security update Red Hat Security Advisories (RHSA) · Oct 7, 2026
RHSA-2026:62231 Red Hat Security Advisory: libXfont2 security update Red Hat Security Advisories (RHSA) · Oct 7, 2026
RHSA-2026:61995 Red Hat Security Advisory: libXfont2 security update Red Hat Security Advisories (RHSA) · Oct 7, 2026
RHSA-2026:61756 Red Hat Security Advisory: libXfont2 security update Red Hat Security Advisories (RHSA) · Oct 7, 2026
RHSA-2026:61755 Red Hat Security Advisory: libXfont2 security update Red Hat Security Advisories (RHSA) · Oct 7, 2026
RHSA-2026:61390 Red Hat Security Advisory: libXfont2 security update Red Hat Security Advisories (RHSA) · Oct 7, 2026
RHSA-2026:59312 Red Hat Security Advisory: libXfont2 security update Red Hat Security Advisories (RHSA) · Oct 7, 2026
RHSA-2026:59311 Red Hat Security Advisory: libXfont2 security update Red Hat Security Advisories (RHSA) · Oct 7, 2026
RHSA-2026:55447 Red Hat Security Advisory: libXfont2 security update Red Hat Security Advisories (RHSA) · Oct 7, 2026
RHSA-2026:55448 Red Hat Security Advisory: libXfont2 security update Red Hat Security Advisories (RHSA) · Oct 7, 2026
RHSA-2026:55446 Red Hat Security Advisory: libXfont2 security update Red Hat Security Advisories (RHSA) · Oct 7, 2026
WID-SEC-2026-2658 X.Org X11 (libXfont2): Mehrere Schwachstellen ermöglichen Privilegieneskalation und Denial of Service BSI CERT-Bund (WID) · Sep 29, 2026
ALAS2-2026-3889 Important: libXfont2 security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Aug 31, 2026
ALAS2-2026-3890 Important: libXfont security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Aug 31, 2026
ALAS2023-2026-2112 Important: libXfont2 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Aug 31, 2026
RLSA-2026:55446 Important: libXfont2 security update Rocky Linux Security Advisories · Aug 17, 2026
RLSA-2026:55447 Important: libXfont2 security update Rocky Linux Security Advisories · Aug 17, 2026
RLSA-2026:55448 Important: libXfont2 security update Rocky Linux Security Advisories · Aug 17, 2026
ELSA-2026-55448 Important: libXfont2 security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Aug 17, 2026
ELSA-2026-55447 Important: libXfont2 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Aug 17, 2026
ELSA-2026-55446 Important: libXfont2 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Aug 17, 2026
SUSE-SU-2026:23151-1 Security update for libXfont2 SUSE / openSUSE Security Updates · Aug 14, 2026
SUSE-SU-2026:23128-1 Security update for libXfont2 SUSE / openSUSE Security Updates · Aug 14, 2026
openSUSE-SU-2026:21539-1 Security update for libXfont2 SUSE / openSUSE Security Updates · Aug 8, 2026
openSUSE-SU-2026:11463-1 libXfont2-2-2.0.7-3.1 on GA media SUSE / openSUSE Security Updates · Aug 7, 2026
SUSE-SU-2026:3499-1 Security update for libXfont2 SUSE / openSUSE Security Updates · Aug 6, 2026
SUSE-SU-2026:3500-1 Security update for libXfont2 SUSE / openSUSE Security Updates · Aug 6, 2026

References

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-59679

CNA	v4.0	9.2
CNA	v3.1	9.0
EUVD	v4.0	9.2