CVE-2026-59679

fs_read_glyphs() heap OOB read/write via encoding array index mismatch in libXfont2

CRITICAL

CVSS Score

Published: September 10, 2026 at 08:15 AM UTC

Updated: September 10, 2026 at 04:18 PM UTC

13 products affected across 2 vendorsLinux Enterprise ServerLinux Enterprise DesktopManager Server

Using Container suse/kiosk/tigervnc-x11vnc:1.14-63.8 by SUSE?

Get instant alerts when new vulnerabilities affect Container suse/kiosk/tigervnc-x11vnc:1.14-63.8 - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

CRITICAL9

Exploit prediction

EPSS 0.3%

SSVC

No known exploit

Description

fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a size derived from num_extents in the separate FS_QueryXExtents16 reply. The two CARD32 fields are never cross-checked. A malicious or compromised font server can send a small num_extents (e.g. 1) in the extents reply, then a large num_chars (e.g. 100000) in the bitmaps reply. This causes attacker-controlled out-of-bounds heap read and writes.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

libXfont2 · LIBXFONT2

60%

? ≤ v ≤ 2.0.8?

Basesystem Module · SUSE

60%

? ≤ v < 2.0.3-150000.3.6.1?

Affected range stops below 2.0.3-150000.3.6.1, so it looks safe — our inference, not a vendor statement

Kiosk · SUSE

60%

? ≤ v < 2.0.3-150000.3.6.1?

Affected range stops below 2.0.3-150000.3.6.1, so it looks safe — our inference, not a vendor statement

Liberty Linux · SUSE

60%

? ≤ v < 2.0.3-12.el9_8.3? ≤ v < 2.0.3-2.el8_10.3? ≤ v < 2.0.6-5.el10_2.3?

Affected range stops below 2.0.3-12.el9_8.3, so it looks safe — our inference, not a vendor statement

Affected range stops below 2.0.3-2.el8_10.3, so it looks safe — our inference, not a vendor statement

Affected range stops below 2.0.6-5.el10_2.3, so it looks safe — our inference, not a vendor statement

Linux Enterprise Desktop · SUSE

60%

? ≤ v < 2.0.3-150000.3.6.1?

Affected range stops below 2.0.3-150000.3.6.1, so it looks safe — our inference, not a vendor statement

Linux Enterprise High Performance Computing · SUSE

60%

? ≤ v < 2.0.3-150000.3.6.1?

Affected range stops below 2.0.3-150000.3.6.1, so it looks safe — our inference, not a vendor statement

Linux Enterprise Server · SUSE

60%

? ≤ v < 2.0.3-150000.3.6.1? ≤ v < 2.0.3-3.6.1? ≤ v < 2.0.7-160000.5.1?

Affected range stops below 2.0.3-150000.3.6.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 2.0.3-3.6.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 2.0.7-160000.5.1, so it looks safe — our inference, not a vendor statement

Linux Enterprise Server for SAP · SUSE

60%

? ≤ v < 2.0.3-150000.3.6.1? ≤ v < 2.0.3-3.6.1? ≤ v < 2.0.7-160000.5.1?

Affected range stops below 2.0.3-150000.3.6.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 2.0.3-3.6.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 2.0.7-160000.5.1, so it looks safe — our inference, not a vendor statement

Manager Proxy · SUSE

60%

? ≤ v < 2.0.3-150000.3.6.1?

Affected range stops below 2.0.3-150000.3.6.1, so it looks safe — our inference, not a vendor statement

Manager Retail Branch Server · SUSE

60%

? ≤ v < 2.0.3-150000.3.6.1?

Affected range stops below 2.0.3-150000.3.6.1, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (1)

Source: cverecord

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-59679

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

9CRITICALsuse

Attack Vector: NETWORK
Complexity: HIGH
Privileges: NONE
User Interaction: NONE
Scope: CHANGED
Confidentiality: HIGH
Integrity: HIGH
Availability: HIGH

Vector?

Quick Info

StatusAWAITING ANALYSIS

CWE

CWE-787

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card