Description

fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice (position, length) lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the allocation. A malicious font server can send overlapping source offsets -- for example 1000 glyphs each referencing {position:0, length:64} with nbytes=64. Each individual source range passes the existing validation, but the cumulative writes total 64000 bytes into a 64-byte destination buffer. This is a heap buffer overflow with attacker-controlled content.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.0",
  "pubDate": "2026-09-10T09:17:02.490Z",
  "pubdate": "2026-09-10T09:17:02.490Z",
  "executiveSummary": "A critical heap-based buffer overflow vulnerability exists in the libXfont2 font-server client within the fs_read_glyphs function. This flaw arises from insufficient bounds checking when aggregating glyph bitmaps into a destination buffer.\nA remote attacker controlling a malicious font server can trigger memory corruption by providing overlapping or redundant glyph ranges. While each individual request passes validation against the source bitmap buffer, the cumulative copy operations exceed the allocated destination heap buffer size.\nSuccessful exploitation allows for arbitrary heap memory corruption with attacker-controlled data, potentially leading to remote code execution or application crashes (denial of service).\nThis vulnerability is particularly dangerous because the font server interaction is often transparent to the user, potentially occurring during standard X session initialization. The impact is elevated given the elevated privileges typically associated with X server components, allowing an attacker to compromise the integrity of the host process.",
  "technicalDetails": "The vulnerability is located in the fs_read_glyphs function within src/fc/fserve.c of the libXfont2 font-server client. The function is responsible for retrieving glyph bitmap data from a remote font server and copying these fragments into a pre-allocated heap buffer.\nThe root cause is an improper validation logic failure where the implementation verifies that the individual source glyph slices (defined by position and length) remain within the bounds of the remote source bitmap. However, the function fails to account for the cumulative growth of the destination buffer during multiple sequential copy operations.\nThe attack flow commences when the libXfont2 client initiates a request to a malicious font server. An attacker can craft a series of glyph responses where each response references a small, valid source slice (e.g., length 64 bytes at position 0). Despite these requests being individually compliant with the source buffer dimensions, the client's internal logic continuously increments the destination pointer and writes these segments into a fixed-size heap allocation.\nBy issuing a high volume of these requests, the attacker can force the cumulative write operations to exceed the bounds of the destination heap buffer. Because the length and content of these writes are controlled by the attacker via the malicious font server response, the overflow permits the overwriting of adjacent heap chunks. This provides a primitive for heap grooming and subsequent code execution if the attacker can successfully overwrite sensitive heap structures, such as function pointers or object headers.\nThe exploitation does not require authentication, as the font-server protocol communication occurs as part of the X server's normal operation. The vulnerability is triggered during the standard processing of font data, meaning any application utilizing libXfont2 to communicate with an untrusted or compromised font server is inherently susceptible to this memory corruption. Post-exploitation impact ranges from controlled crashes resulting in a Denial of Service (DoS) to full process takeover by redirecting control flow through overwritten heap metadata or application data."
}