VulnSocial

CVE-2026-44950Disclosure

LOWCVSS 9.5 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice (position, length) lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the allocation. A malicious font server can send overlapping source offsets -- for example 1000 glyphs each referencing {position:0, length:64} with nbytes=64. Each individual source range passes the existing validation, but the cumulative writes total 64000 bytes into a 64-byte destination buffer. This is a heap buffer overflow with attacker-controlled content.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-122

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-09-10: 1Technical Details · 2026-09-10: 109-10
Signal classification1 categories
Disclosure
1100.0%
Full discourse1 post
  • Upwind Security MDR@UpwindMDR
    Disclosure

    🚨Critical - libXfont2 fs_read_glyphs() Heap Buffer Overflow via Malicious Font Server (CVE-2026-44950) libXfont2 font-server client fs_read_glyphs() copies multiple glyph bitmaps into a single heap buffer but only bounds-checks each glyph slice, not the cumulative destination write. A rogue X font server can send many glyphs with overlapping source offsets so each memcpy passes validation while total bytes overflow the heap buffer, enabling remote memory corruption/RCE over the network. 👉Affected: libXfont2-2/libXfont2/libXfont2-devel (all versions)

    Post summary

    A new critical heap buffer overflow (CVE‑2026‑44950) has been disclosed for libXfont2's fs_read_glyphs, enabling remote memory corruption/RCE via malicious font servers, with all versions of libXfont2 affected.

    0000081
    303 followersView on X

Explore more

Back to dashboard