CVE Feed

    Dashboard / CVE / CVE-2026-56002

    CVE-2026-56002

    A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8  allows attackers authenticated as X client to execute code within the X server.

    Published:Jul 8, 2026
    Last Modified:Jul 10, 2026
    EPS:Jul 8, 2026
    EPSS Score:0.00529
    CVSS Score:8.5

    Affected Products

    Vendor
    X.org
    Product
    Libxfont
    Vendor
    X.org
    Product
    Libxfont2

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-92 Forced Integer Overflow

    Related CVEs

    CVE-2026-56003 (CVSS 8.5) — A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2…
    CVE-2026-56001 (CVSS 8.5) — A heap buffer overflow in BitmapScaleBitmaps in libXfont2 before 2.0.8 due to an overflowing 32bit size could …
    CVE-2017-13720 (CVSS 7.1) — In the PatternMatch function in fontfile/fontdir.c in libXfont through 1.5.2 and 2.x before 2.0.2, an attacker…
    CVE-2017-13722 (CVSS 7.1) — In the pcfGetProperties function in bitmap/pcfread.c in libXfont through 1.5.2 and 2.x before 2.0.2, a missing…
    CVE-2007-1352 (CVSS 3.8) — Integer overflow in the FontFileInitTable function in X.Org libXfont before 20070403 allows remote authenticat…
    CVE-2007-1351 (CVSS 8.5) — Integer overflow in the bdfReadCharacters function in bdfread.c in (1) X.Org libXfont before 20070403 and (2) …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High