CVE-2026-56001 Details
Description
A heap buffer overflow in BitmapScaleBitmaps in libXfont2 before 2.0.8 due to an overflowing 32bit size could be used by attackers able to access the X Server to execute code within the X server cont
A heap buffer overflow vulnerability has been identified in libXfont2 versions prior to 2.0.8. The issue arises in the BitmapScaleBitmaps function, where a 32-bit variable that tracks the number of bytes to allocate can overflow. This overflow leads to an allocation of insufficient buffer size, allowing attackers to write beyond the allocated memory. The vulnerability can be exploited by loading a crafted PCF font into the X Server at a scale factor that increases per-glyph byte counts.
Users can upgrade to libXfont2 version 2.0.8 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit/be0b08e2d354138d3222b4490e2a77c6ee42f778 | [email protected] | Patch |
| https://www.openwall.com/lists/oss-security/2026/07/08/1 | [email protected] | Mailing ListPatchThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-122 | Heap-based Buffer Overflow | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| x libxfont | >= 2.0.0, < 2.0.8 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 9, 2026 | Initial Analysis | [email protected] |
| Jul 9, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | New CVE Received | [email protected] |