Description

fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a size derived from num_extents in the separate FS_QueryXExtents16 reply. The two CARD32 fields are never cross-checked. A malicious or compromised font server can send a small num_extents (e.g. 1) in the extents reply, then a large num_chars (e.g. 100000) in the bitmaps reply. This causes attacker-controlled out-of-bounds heap read and writes.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.0",
  "pubDate": "2026-09-10T09:17:02.883Z",
  "pubdate": "2026-09-10T09:17:02.883Z",
  "executiveSummary": "The libXfont2 library contains a critical heap-based out-of-bounds read and write vulnerability within its font-server client implementation. The flaw exists in the fs_read_glyphs function in src/fc/fserve.c, arising from improper validation of length fields received from a font server.\nSpecifically, the component fails to synchronize the num_chars and num_extents values retrieved from independent FS_QueryXBitmaps16 and FS_QueryXExtents16 replies. Because the heap buffer allocation is sized according to the potentially smaller num_extents value, while subsequent data processing utilizes the larger num_chars value for indexing, the system becomes susceptible to memory corruption.\nA malicious or compromised font server can trigger this condition by providing asymmetrical values, leading to controlled out-of-bounds heap operations. Successful exploitation allows for memory corruption, potential information disclosure, or arbitrary code execution under the context of the X server or client application interacting with the font server. The vulnerability requires a network-exposed or malicious font server to be reachable by the victim's client.",
  "technicalDetails": "The vulnerability originates in the fs_read_glyphs() function within src/fc/fserve.c of the libXfont2 font-server client. The function is responsible for parsing font glyph data received from an external font server. The process involves two distinct X font server protocol exchanges: the query for extents and the query for bitmaps.\nThe root cause is a lack of strict cross-verification between two CARD32 fields: num_extents, obtained via the FS_QueryXExtents16 reply, and num_chars, obtained via the FS_QueryXBitmaps16 reply. The client allocates an internal encoding[] array on the heap, where the allocation size is derived from num_extents. However, the subsequent processing loop, which populates and reads from this array, relies on the num_chars field to determine the iteration bounds and index values.\nAn attacker controlling a malicious font server can deliberately transmit a small value for num_extents to minimize the initial memory allocation, followed by a significantly larger value for num_chars in the subsequent bitmap reply. When fs_read_glyphs() processes the bitmap reply, it iterates up to num_chars, attempting to write data into the encoding[] array based on the num_chars count.\nBecause the heap buffer was undersized based on the extents, this leads to an out-of-bounds (OOB) write operation beyond the allocated memory segment. Furthermore, subsequent reads from the encoding[] array using the same num_chars loop will result in OOB reads, allowing for the disclosure of heap memory contents.\nThis behavior facilitates memory corruption on the heap, which can be leveraged to overwrite adjacent heap metadata or function pointers. If successful, an attacker could achieve arbitrary code execution by redirecting execution flow. The attack flow is initiated when an X client attempts to load a font from a server controlled by the attacker. Since the protocol does not enforce a strict relationship between the extents and bitmap count, the client fails to perform the necessary bounds checking to prevent this memory overrun. The impact is significant as it affects the core rendering logic of X clients utilizing font servers, potentially compromising the integrity and security of the client-side environment."
}