CVE-2026-59679: libXfont2 Buffer Overflow Vulnerability

CVE-2026-59679 Overview

CVE-2026-59679 is an out-of-bounds heap read and write vulnerability in the fs_read_glyphs() function of the libXfont2 font-server client. The flaw resides in src/fc/fserve.c, where the per-character encoding[] array is indexed using num_chars from an FS_QueryXBitmaps16 reply. The array itself was allocated based on num_extents from a separate FS_QueryXExtents16 reply. Because these two CARD32 fields are never cross-checked, a malicious font server can trigger attacker-controlled memory corruption in any client linked against libXfont2.

Critical Impact
A compromised or malicious font server can achieve out-of-bounds heap reads and writes against connecting X clients, enabling memory corruption and potential code execution.

Affected Products

libXfont2 font-server client library
X.Org components and X servers linking libXfont2 for font-server (FS) protocol support
Linux distributions shipping libXfont2 (see SUSE Bug Report CVE-2026-59679)

Discovery Timeline

2026-09-10 - CVE-2026-59679 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-59679

Vulnerability Analysis

The vulnerability affects the font-server (FS) protocol client code inside libXfont2. When a client requests glyphs, fs_read_glyphs() processes two separate replies from the font server. The first reply, FS_QueryXExtents16, contains a num_extents field that determines the allocation size of the per-character encoding[] array. The second reply, FS_QueryXBitmaps16, contains a num_chars field that the function uses to iterate and index into that same array.

Because fs_read_glyphs() never validates that num_chars is less than or equal to num_extents, the loop can index far beyond the allocated buffer. This condition results in both out-of-bounds heap reads and out-of-bounds heap writes, with the offsets controlled by attacker-supplied values in the FS protocol replies. The vulnerability is classified as an Out-of-Bounds Write ([CWE-787]) and Out-of-Bounds Read ([CWE-125]).

Root Cause

The root cause is missing cross-validation between two independent CARD32 fields returned by distinct font-server responses. The allocation size and the index bound originate from separate protocol messages, and the client trusts both without verifying their consistency.

Attack Vector

An attacker who controls or compromises a font server can craft matched replies that trigger the mismatch. Sending num_extents = 1 in the extents reply followed by num_chars = 100000 in the bitmaps reply causes fs_read_glyphs() to write and read far past the end of the encoding[] heap allocation. Exploitation requires the victim client to connect to the attacker-controlled font server, which limits reach but permits memory corruption in the client process.

No public proof-of-concept code has been published. Refer to the SUSE Bug Report CVE-2026-59679 for upstream analysis.

Detection Methods for CVE-2026-59679

Indicators of Compromise

Unexpected outbound TCP connections from X server or font-consuming processes to unknown font servers on port 7100/tcp.
X clients or servers crashing with SIGSEGV or heap corruption traces inside libXfont2 symbols such as fs_read_glyphs.
Font-server configuration files (/etc/X11/fs/config, catalogue= entries) referencing untrusted or externally controlled tcp/ endpoints.

Detection Strategies

Inventory hosts with installed libXfont2 versions and correlate against distribution security advisories.
Alert on X server processes establishing network sockets to non-loopback addresses on the FS protocol port.
Monitor for abnormal termination of processes linked to libXfont2 and capture core dumps for triage.

Monitoring Recommendations

Enable process telemetry to record command lines and loaded modules for X-related binaries.
Track file integrity on font-server configuration files and font path settings.
Capture network flow logs for FS protocol traffic and baseline expected font servers.

How to Mitigate CVE-2026-59679

Immediate Actions Required

Disable use of remote font servers and remove tcp/ entries from X font paths where feasible.
Restrict outbound access to font-server ports so clients can only reach trusted, internal font servers.
Apply distribution updates for libXfont2 as soon as vendor patches become available.

Patch Information

At the time of publication, patch metadata is not present in the NVD entry. Track the upstream fix and downstream backports through the SUSE Bug Report CVE-2026-59679 and monitor advisories from your Linux distribution for updated libXfont2 packages.

Workarounds

Remove font-server (fs/, xfs) entries from FontPath and rely on local font directories only.
Block egress to TCP port 7100 at the host or network firewall to prevent connections to untrusted font servers.
Run X servers and font-consuming applications under least-privilege accounts to limit blast radius from memory corruption.

bash

# Remove remote font-server entries and reload the X font path
xset -fp tcp/untrusted-fontserver:7100
xset fp rehash

# Verify no tcp/ font paths remain
xset q | grep -i "font path"