By vendor

X vulnerabilities

Known CVEs affecting X products, prioritized by severity, with SEC.co remediation and detection guidance.

3 published vulnerabilities

• CVE-2026-56001HIGH 8.5

  A heap buffer overflow exists in libXfont2, a font rendering library used by X Server. The vulnerability occurs when the BitmapScaleBitmaps function processes specially crafted font data with oversized 32-bit values that exceed buffer boundaries. An authenticated attacker who can communicate with the X Server could exploit this flaw to execute arbitrary code with X Server privileges. The vulnerability affects libXfont2 versions prior to 2.0.8.

• CVE-2026-56002HIGH 8.5

  A memory corruption flaw in libXfont2 allows authenticated X clients to crash the X server or execute arbitrary code within it. The vulnerability exists in the font file parsing function pcfReadFont(), which fails to validate glyph boundary data before writing to heap memory. An attacker with valid X client credentials can trigger this condition by supplying a malformed font file, potentially compromising the entire X display session and any services relying on it.

• CVE-2026-56003HIGH 8.5

  A heap buffer overflow exists in libXfont2, the font library used by X servers. When processing specially crafted PCF (Portable Compiled Font) files, the ComputeScaledProperties() function fails to validate buffer sizes properly, allowing an authenticated X client to trigger memory corruption and execute arbitrary code with X server privileges. The vulnerability requires an authenticated connection to an X server and careful exploitation, but succeeds regardless of memory protections on vulnerable systems.