CVE-2026-44950

A flaw was found in the libXfont2 font-server client. This heap buffer overflow vulnerability allows a malicious font server to send specially crafted glyph data. The fs_read_glyphs() function fails to properly validate the total size of the incoming data, leading to an overwrite of memory beyond the intended buffer. If the X server runs as a privileged user, this could result in privilege escalation, allowing an attacker to gain higher access. If the X server runs as an unprivileged user, it could lead to a denial of service, causing the system to crash.

This is an Important flaw. A heap buffer overflow in the libXfont2 font server client can be triggered by a malicious font server. If the X server runs as root, this could lead to privilege escalation; otherwise, it results in a denial of service. Red Hat Enterprise Linux typically runs the X server as an unprivileged user, mitigating the privilege escalation risk but still allowing for denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Avoid connecting the X server to untrusted or remote font servers by restricting font path definitions to local storage.

1. Inspect X server configuration files (located in /etc/X11/xorg.conf or /etc/X11/xorg.conf.d/) and remove any FontPath entries pointing to external or remote font servers (such as tcp/<hostname>:<port>). Retain only local directory paths or catalogue references (for example, /usr/share/fonts or catalogue:/etc/X11/fontpath.d).

2. Ensure that remote font servers are not added dynamically to running sessions using utilities such as xset (e.g., xset +fp tcp/...).

Warning: Applying configuration changes to the X server requires restarting the display manager (for example, systemctl restart gdm), which will terminate active graphical user sessions and close running applications.