Description

Fluxbox through 1.3.7 contains an infinite loop vulnerability in Menu::updateMenu() in src/FbTk/Menu.cc that allows attackers to hang the window manager via crafted style geometry values. Attackers can supply a style with an oversized unbounded menu.titleHeight so the column loop never terminates, causing sustained CPU use and denial of service at startup.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-11-06T15:17:21.467Z",
  "pubdate": "2026-11-06T15:17:21.467Z",
  "executiveSummary": "Fluxbox versions through 1.3.7 are susceptible to a Denial of Service (DoS) vulnerability triggered by an infinite loop within the menu rendering logic.\nThe vulnerability originates from improper validation of style geometry parameters, specifically the menu.titleHeight attribute.\nAn unauthenticated local or remote attacker capable of influencing the window manager's style configuration can supply a crafted, oversized, or unbounded value for the menu title height.\nThis malformed input causes the application's column iteration logic in the FbTk library to enter an infinite loop during the startup process or when applying the style.\nThe exploitation results in a persistent 100% CPU utilization state, effectively hanging the window manager and rendering the graphical user interface unresponsive.\nThe impact is a complete loss of service for the Fluxbox session, requiring manual intervention or process termination to restore functionality.\nNo specific authentication or escalated privileges are required to initiate the attack if the attacker can place a malicious configuration file in a location read by the target user or system.",
  "technicalDetails": "The vulnerability resides in the src/FbTk/Menu.cc file within the Menu::updateMenu() function, which is responsible for calculating the dimensions and layout of menu components during the initialization of the Fluxbox window manager.\nThe root cause is an absence of boundary validation for user-supplied style geometry settings, specifically the 'menu.titleHeight' property. When Fluxbox parses a style configuration file, it utilizes these values to determine the vertical space allocated to menu headers.\nDuring the execution of Menu::updateMenu(), the application enters a column calculation loop intended to compute the vertical positions of menu items. If the 'menu.titleHeight' is set to an intentionally large or unbounded value, the internal loop counters or conditional exit criteria fail to terminate, as the calculated cumulative height fails to trigger the loop's exit condition against the parent container dimensions.\nThe attack flow proceeds as follows: First, the attacker provides a crafted Fluxbox style file containing an exceptionally large 'menu.titleHeight' value. This file may be delivered via a malicious theme package or by modifying a local configuration file if the attacker has gained low-privileged file system access.\nUpon the next initialization of the Fluxbox session, or when the user triggers a 'reconfigure' command to reload styles, the FbTk library attempts to process the invalid height variable.\nThe Menu::updateMenu() function invokes the column generation logic. Due to the oversized geometry value, the iterative process enters an infinite loop. The process remains trapped in this execution block, consuming available CPU resources continuously.\nBecause Fluxbox is a monolithic window manager, the hang impacts the entire desktop environment, preventing the user from interacting with windows, the taskbar, or the system menu. This results in an effective Denial of Service. There is no specific authentication required for the attack itself; the primary barrier is the attacker's ability to influence the configuration files read by the Fluxbox process."
}