Skip to content
CVE PROGRAM SOURCE RECORD9.5 Critical

CVE-2026-44950

fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow in libXfont2

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
suse

Description

fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice (position, length) lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the allocation. A malicious font server can send overlapping source offsets -- for example 1000 glyphs each referencing {position:0, length:64} with nbytes=64. Each individual source range passes the existing validation, but the cumulative writes total 64000 bytes into a 64-byte destination buffer. This is a heap buffer overflow with attacker-controlled content.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SUSE Container suse/kiosk/tigervnc-x11vnc:1.14-63.8

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE Container suse/kiosk/xorg:21.1-83.7

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE Image SLES15-SP6-SAP

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE Image SLES15-SP6-SAP-Azure

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE Image SLES15-SP6-SAP-Azure-3P

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE Image SLES15-SP6-SAP-BYOS

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE Image SLES15-SP6-SAP-BYOS-Azure

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE Image SLES15-SP6-SAP-BYOS-EC2

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE Image SLES15-SP6-SAP-BYOS-GCE

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE Image SLES15-SP6-SAP-EC2

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE Image SLES15-SP6-SAP-GCE

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE Image SLES15-SP6-SAP-Hardened

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE Image SLES15-SP6-SAP-Hardened-Azure

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE Image SLES15-SP6-SAP-Hardened-BYOS

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE Image SLES15-SP6-SAP-Hardened-BYOS-Azure

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE Image SLES15-SP6-SAP-Hardened-BYOS-EC2

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE Image SLES15-SP6-SAP-Hardened-BYOS-GCE

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE Image SLES15-SP6-SAP-Hardened-EC2

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE Image SLES15-SP6-SAP-Hardened-GCE

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE Image SLES15-SP6-SAPCAL

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE Image SLES15-SP6-SAPCAL-Azure

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE Image SLES15-SP6-SAPCAL-EC2

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE Image SLES15-SP6-SAPCAL-GCE

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE Image SLES15-SP7-SAP-Azure

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE Image SLES15-SP7-SAP-Azure-3P

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE Image SLES15-SP7-SAP-BYOS-Azure

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE Image SLES15-SP7-SAP-BYOS-EC2

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE Image SLES15-SP7-SAP-BYOS-GCE

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE Image SLES15-SP7-SAP-EC2

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE Image SLES15-SP7-SAP-GCE

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE Image SLES15-SP7-SAP-GCE-3P

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE Image SLES15-SP7-SAP-Hardened-Azure

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE Image SLES15-SP7-SAP-Hardened-BYOS-Azure

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE Image SLES15-SP7-SAP-Hardened-BYOS-EC2

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE Image SLES15-SP7-SAP-Hardened-BYOS-GCE

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE Image SLES15-SP7-SAP-Hardened-GCE

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE Image SLES15-SP7-SAPCAL-Azure

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE Image SLES15-SP7-SAPCAL-EC2

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE Image SLES15-SP7-SAPCAL-GCE

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE Image SLES-SAP-Azure

Default version status: unaffected

  • ? to < 2.0.7-160000.5.1affected

SUSE Image SLES-SAP-Azure-3P

Default version status: unaffected

  • ? to < 2.0.7-160000.5.1affected

SUSE Image SLES-SAP-BYOS-Azure

Default version status: unaffected

  • ? to < 2.0.7-160000.5.1affected

SUSE Image SLES-SAP-BYOS-EC2

Default version status: unaffected

  • ? to < 2.0.7-160000.5.1affected

SUSE Image SLES-SAP-BYOS-GCE

Default version status: unaffected

  • ? to < 2.0.7-160000.5.1affected

SUSE Image SLES-SAP-GCE

Default version status: unaffected

  • ? to < 2.0.7-160000.5.1affected

SUSE Image SLES-SAP-GCE-3P

Default version status: unaffected

  • ? to < 2.0.7-160000.5.1affected

SUSE Image SLES-SAPCAL-GCE

Default version status: unaffected

  • ? to < 2.0.7-160000.5.1affected

SUSE Image SLES12-SP5-Azure-SAP-BYOS

Default version status: unaffected

  • ? to < 2.0.3-3.6.1affected

SUSE Image SLES12-SP5-Azure-SAP-On-Demand

Default version status: unaffected

  • ? to < 2.0.3-3.6.1affected

SUSE Image SLES12-SP5-EC2-SAP-BYOS

Default version status: unaffected

  • ? to < 2.0.3-3.6.1affected

SUSE Image SLES12-SP5-EC2-SAP-On-Demand

Default version status: unaffected

  • ? to < 2.0.3-3.6.1affected

SUSE Image SLES12-SP5-GCE-SAP-BYOS

Default version status: unaffected

  • ? to < 2.0.3-3.6.1affected

SUSE Image SLES12-SP5-GCE-SAP-On-Demand

Default version status: unaffected

  • ? to < 2.0.3-3.6.1affected

SUSE SUSE Liberty Linux 10

Default version status: unaffected

  • ? to < 2.0.6-5.el10_2.3affected

SUSE SUSE Liberty Linux 10

Default version status: unaffected

  • ? to < 2.0.6-5.el10_2.3affected

SUSE SUSE Liberty Linux 8

Default version status: unaffected

  • ? to < 2.0.3-2.el8_10.3affected

SUSE SUSE Liberty Linux 8

Default version status: unaffected

  • ? to < 2.0.3-2.el8_10.3affected

SUSE SUSE Liberty Linux 9

Default version status: unaffected

  • ? to < 2.0.3-12.el9_8.3affected

SUSE SUSE Liberty Linux 9

Default version status: unaffected

  • ? to < 2.0.3-12.el9_8.3affected

SUSE SUSE Linux Enterprise Desktop 15 SP7

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE SUSE Linux Enterprise Desktop 15 SP7

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE SUSE Linux Enterprise Module for Basesystem 15 SP7

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE SUSE Linux Enterprise Module for Basesystem 15 SP7

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE SUSE Linux Enterprise Server 15 SP7

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE SUSE Linux Enterprise Server 15 SP7

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP7

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP7

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE SUSE Linux Enterprise Server 12 SP5-LTSS

Default version status: unaffected

  • ? to < 2.0.3-3.6.1affected

SUSE SUSE Linux Enterprise Server 15 SP4-LTSS

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE SUSE Linux Enterprise Server 15 SP4-LTSS

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE SUSE Linux Enterprise Server 15 SP5-LTSS

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE SUSE Linux Enterprise Server 15 SP5-LTSS

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE SUSE Linux Enterprise Server 15 SP6-LTSS

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE SUSE Linux Enterprise Server 15 SP6-LTSS

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE SUSE Linux Enterprise Server 16.0

Default version status: unaffected

  • ? to < 2.0.7-160000.5.1affected

SUSE SUSE Linux Enterprise Server 16.0

Default version status: unaffected

  • ? to < 2.0.7-160000.5.1affected

SUSE SUSE Linux Enterprise Server for SAP applications 16.0

Default version status: unaffected

  • ? to < 2.0.7-160000.5.1affected

SUSE SUSE Linux Enterprise Server for SAP applications 16.0

Default version status: unaffected

  • ? to < 2.0.7-160000.5.1affected

SUSE SUSE Linux Enterprise Server LTSS Extended Security 12 SP5

Default version status: unaffected

  • ? to < 2.0.3-3.6.1affected

SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP4

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP4

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP5

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP5

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP6

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP6

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE SUSE Manager Proxy LTS 4.3

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE SUSE Manager Proxy LTS 4.3

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE SUSE Manager Retail Branch Server LTS 4.3

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE SUSE Manager Retail Branch Server LTS 4.3

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE SUSE Manager Server LTS 4.3

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE SUSE Manager Server LTS 4.3

Default version status: unaffected

  • ? to < 2.0.3-150000.3.6.1affected

SUSE openSUSE Leap 16.0

Default version status: unaffected

  • ? to < 2.0.7-160000.5.1affected

SUSE openSUSE Leap 16.0

Default version status: unaffected

  • ? to < 2.0.7-160000.5.1affected

SUSE openSUSE Tumbleweed

Default version status: unaffected

  • ? to < 2.0.7-3.1affected

SUSE openSUSE Tumbleweed

Default version status: unaffected

  • ? to < 2.0.7-3.1affected

SUSE openSUSE Tumbleweed

Default version status: unaffected

  • ? to < 2.0.7-3.1affected

SUSE openSUSE Tumbleweed

Default version status: unaffected

  • ? to < 2.0.7-3.1affected

libXfont libXfont

Default version status: unaffected

  • ? to ≤ 2.0.8affected

References