CVE-2026-59679

fs_read_glyphs() heap OOB read/write via encoding array index mismatch in libXfont2

State: Published
Severity: 9.2 Critical
Published: Sep 10, 2026
Updated: Sep 10, 2026
Reserved: Jul 6, 2026

Description

fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a size derived from num_extents in the separate FS_QueryXExtents16 reply. The two CARD32 fields are never cross-checked. A malicious or compromised font server can send a small num_extents (e.g. 1) in the extents reply, then a large num_chars (e.g. 100000) in the bitmaps reply. This causes attacker-controlled out-of-bounds heap read and writes.

Scores

CVSS	Score	Vector	Source
4.0	9.2 Critical	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	suse
3.1	9.0 Critical	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H	suse

Weaknesses

CWE-787 Out-of-bounds Write

Affected Products

Product	Versions
Container suse/kiosk/tigervnc-x11vnc:1.14-63.8SUSE	? to before 2.0.3-150000.3.6.1Affected
Container suse/kiosk/xorg:21.1-83.7SUSE	? to before 2.0.3-150000.3.6.1Affected
Image SLES15-SP6-SAPSUSE	? to before 2.0.3-150000.3.6.1Affected
Image SLES15-SP6-SAP-AzureSUSE	? to before 2.0.3-150000.3.6.1Affected
Image SLES15-SP6-SAP-Azure-3PSUSE	? to before 2.0.3-150000.3.6.1Affected
Image SLES15-SP6-SAP-BYOSSUSE	? to before 2.0.3-150000.3.6.1Affected
Image SLES15-SP6-SAP-BYOS-AzureSUSE	? to before 2.0.3-150000.3.6.1Affected
Image SLES15-SP6-SAP-BYOS-EC2SUSE	? to before 2.0.3-150000.3.6.1Affected
Image SLES15-SP6-SAP-BYOS-GCESUSE	? to before 2.0.3-150000.3.6.1Affected
Image SLES15-SP6-SAP-EC2SUSE	? to before 2.0.3-150000.3.6.1Affected
Image SLES15-SP6-SAP-GCESUSE	? to before 2.0.3-150000.3.6.1Affected
Image SLES15-SP6-SAP-HardenedSUSE	? to before 2.0.3-150000.3.6.1Affected
Image SLES15-SP6-SAP-Hardened-AzureSUSE	? to before 2.0.3-150000.3.6.1Affected
Image SLES15-SP6-SAP-Hardened-BYOSSUSE	? to before 2.0.3-150000.3.6.1Affected
Image SLES15-SP6-SAP-Hardened-BYOS-AzureSUSE	? to before 2.0.3-150000.3.6.1Affected
Image SLES15-SP6-SAP-Hardened-BYOS-EC2SUSE	? to before 2.0.3-150000.3.6.1Affected
Image SLES15-SP6-SAP-Hardened-BYOS-GCESUSE	? to before 2.0.3-150000.3.6.1Affected
Image SLES15-SP6-SAP-Hardened-EC2SUSE	? to before 2.0.3-150000.3.6.1Affected
Image SLES15-SP6-SAP-Hardened-GCESUSE	? to before 2.0.3-150000.3.6.1Affected
Image SLES15-SP6-SAPCALSUSE	? to before 2.0.3-150000.3.6.1Affected
Image SLES15-SP6-SAPCAL-AzureSUSE	? to before 2.0.3-150000.3.6.1Affected
Image SLES15-SP6-SAPCAL-EC2SUSE	? to before 2.0.3-150000.3.6.1Affected
Image SLES15-SP6-SAPCAL-GCESUSE	? to before 2.0.3-150000.3.6.1Affected
Image SLES15-SP7-SAP-AzureSUSE	? to before 2.0.3-150000.3.6.1Affected
Image SLES15-SP7-SAP-Azure-3PSUSE	? to before 2.0.3-150000.3.6.1Affected
Image SLES15-SP7-SAP-BYOS-AzureSUSE	? to before 2.0.3-150000.3.6.1Affected
Image SLES15-SP7-SAP-BYOS-EC2SUSE	? to before 2.0.3-150000.3.6.1Affected
Image SLES15-SP7-SAP-BYOS-GCESUSE	? to before 2.0.3-150000.3.6.1Affected
Image SLES15-SP7-SAP-EC2SUSE	? to before 2.0.3-150000.3.6.1Affected
Image SLES15-SP7-SAP-GCESUSE	? to before 2.0.3-150000.3.6.1Affected
Image SLES15-SP7-SAP-GCE-3PSUSE	? to before 2.0.3-150000.3.6.1Affected
Image SLES15-SP7-SAP-Hardened-AzureSUSE	? to before 2.0.3-150000.3.6.1Affected
Image SLES15-SP7-SAP-Hardened-BYOS-AzureSUSE	? to before 2.0.3-150000.3.6.1Affected
Image SLES15-SP7-SAP-Hardened-BYOS-EC2SUSE	? to before 2.0.3-150000.3.6.1Affected
Image SLES15-SP7-SAP-Hardened-BYOS-GCESUSE	? to before 2.0.3-150000.3.6.1Affected
Image SLES15-SP7-SAP-Hardened-GCESUSE	? to before 2.0.3-150000.3.6.1Affected
Image SLES15-SP7-SAPCAL-AzureSUSE	? to before 2.0.3-150000.3.6.1Affected
Image SLES15-SP7-SAPCAL-EC2SUSE	? to before 2.0.3-150000.3.6.1Affected
Image SLES15-SP7-SAPCAL-GCESUSE	? to before 2.0.3-150000.3.6.1Affected
Image SLES-SAP-AzureSUSE	? to before 2.0.7-160000.5.1Affected
Image SLES-SAP-Azure-3PSUSE	? to before 2.0.7-160000.5.1Affected
Image SLES-SAP-BYOS-AzureSUSE	? to before 2.0.7-160000.5.1Affected
Image SLES-SAP-BYOS-EC2SUSE	? to before 2.0.7-160000.5.1Affected
Image SLES-SAP-BYOS-GCESUSE	? to before 2.0.7-160000.5.1Affected
Image SLES-SAP-GCESUSE	? to before 2.0.7-160000.5.1Affected
Image SLES-SAP-GCE-3PSUSE	? to before 2.0.7-160000.5.1Affected
Image SLES-SAPCAL-GCESUSE	? to before 2.0.7-160000.5.1Affected
Image SLES12-SP5-Azure-SAP-BYOSSUSE	? to before 2.0.3-3.6.1Affected
Image SLES12-SP5-Azure-SAP-On-DemandSUSE	? to before 2.0.3-3.6.1Affected
Image SLES12-SP5-EC2-SAP-BYOSSUSE	? to before 2.0.3-3.6.1Affected
Image SLES12-SP5-EC2-SAP-On-DemandSUSE	? to before 2.0.3-3.6.1Affected
Image SLES12-SP5-GCE-SAP-BYOSSUSE	? to before 2.0.3-3.6.1Affected
Image SLES12-SP5-GCE-SAP-On-DemandSUSE	? to before 2.0.3-3.6.1Affected
SUSE Liberty Linux 10SUSE	? to before 2.0.6-5.el10_2.3Affected
SUSE Liberty Linux 10SUSE	? to before 2.0.6-5.el10_2.3Affected
SUSE Liberty Linux 8SUSE	? to before 2.0.3-2.el8_10.3Affected
SUSE Liberty Linux 8SUSE	? to before 2.0.3-2.el8_10.3Affected
SUSE Liberty Linux 9SUSE	? to before 2.0.3-12.el9_8.3Affected
SUSE Liberty Linux 9SUSE	? to before 2.0.3-12.el9_8.3Affected
SUSE Linux Enterprise Desktop 15 SP7SUSE	? to before 2.0.3-150000.3.6.1Affected
SUSE Linux Enterprise Desktop 15 SP7SUSE	? to before 2.0.3-150000.3.6.1Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7SUSE	? to before 2.0.3-150000.3.6.1Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7SUSE	? to before 2.0.3-150000.3.6.1Affected
SUSE Linux Enterprise Server 15 SP7SUSE	? to before 2.0.3-150000.3.6.1Affected
SUSE Linux Enterprise Server 15 SP7SUSE	? to before 2.0.3-150000.3.6.1Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7SUSE	? to before 2.0.3-150000.3.6.1Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7SUSE	? to before 2.0.3-150000.3.6.1Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE	? to before 2.0.3-150000.3.6.1Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE	? to before 2.0.3-150000.3.6.1Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE	? to before 2.0.3-150000.3.6.1Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE	? to before 2.0.3-150000.3.6.1Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSSUSE	? to before 2.0.3-150000.3.6.1Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSSUSE	? to before 2.0.3-150000.3.6.1Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSSSUSE	? to before 2.0.3-150000.3.6.1Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSSSUSE	? to before 2.0.3-150000.3.6.1Affected
SUSE Linux Enterprise Server 12 SP5-LTSSSUSE	? to before 2.0.3-3.6.1Affected
SUSE Linux Enterprise Server 15 SP4-LTSSSUSE	? to before 2.0.3-150000.3.6.1Affected
SUSE Linux Enterprise Server 15 SP4-LTSSSUSE	? to before 2.0.3-150000.3.6.1Affected
SUSE Linux Enterprise Server 15 SP5-LTSSSUSE	? to before 2.0.3-150000.3.6.1Affected
SUSE Linux Enterprise Server 15 SP5-LTSSSUSE	? to before 2.0.3-150000.3.6.1Affected
SUSE Linux Enterprise Server 15 SP6-LTSSSUSE	? to before 2.0.3-150000.3.6.1Affected
SUSE Linux Enterprise Server 15 SP6-LTSSSUSE	? to before 2.0.3-150000.3.6.1Affected
SUSE Linux Enterprise Server 16.0SUSE	? to before 2.0.7-160000.5.1Affected
SUSE Linux Enterprise Server 16.0SUSE	? to before 2.0.7-160000.5.1Affected
SUSE Linux Enterprise Server for SAP applications 16.0SUSE	? to before 2.0.7-160000.5.1Affected
SUSE Linux Enterprise Server for SAP applications 16.0SUSE	? to before 2.0.7-160000.5.1Affected
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5SUSE	? to before 2.0.3-3.6.1Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP4SUSE	? to before 2.0.3-150000.3.6.1Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP4SUSE	? to before 2.0.3-150000.3.6.1Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP5SUSE	? to before 2.0.3-150000.3.6.1Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP5SUSE	? to before 2.0.3-150000.3.6.1Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP6SUSE	? to before 2.0.3-150000.3.6.1Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP6SUSE	? to before 2.0.3-150000.3.6.1Affected
SUSE Manager Proxy LTS 4.3SUSE	? to before 2.0.3-150000.3.6.1Affected
SUSE Manager Proxy LTS 4.3SUSE	? to before 2.0.3-150000.3.6.1Affected
SUSE Manager Retail Branch Server LTS 4.3SUSE	? to before 2.0.3-150000.3.6.1Affected
SUSE Manager Retail Branch Server LTS 4.3SUSE	? to before 2.0.3-150000.3.6.1Affected
SUSE Manager Server LTS 4.3SUSE	? to before 2.0.3-150000.3.6.1Affected
SUSE Manager Server LTS 4.3SUSE	? to before 2.0.3-150000.3.6.1Affected
openSUSE Leap 16.0SUSE	? to before 2.0.7-160000.5.1Affected
openSUSE Leap 16.0SUSE	? to before 2.0.7-160000.5.1Affected
openSUSE TumbleweedSUSE	? to before 2.0.7-3.1Affected
openSUSE TumbleweedSUSE	? to before 2.0.7-3.1Affected
openSUSE TumbleweedSUSE	? to before 2.0.7-3.1Affected
openSUSE TumbleweedSUSE	? to before 2.0.7-3.1Affected
libXfont2libXfont2	? through 2.0.8Affected

References

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-59679

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.