Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 439
Alerts This Week
Warning Icon 1 439

Debian LTS libxfont Critical Heap Overflow Threat DLA-4678-1 CVE-2026-56001

debian lts
Calendar Grey July 12, 2026
Dist Debian Esm H88
Heap overflows in libxfont allow authenticated attackers to execute code in X server context. Update recommended.
A series of heap overflows in bitmap/PCF parser code could be used by authenticated attackers to execute code in the X server context
Topics%20covered

Topics Covered

security advisory critical heap overflow libxfont authenticated access deblts

Summary

CVE-2026-56001

A heap buffer overflow in BitmapScaleBitmaps in due to an overflowing
32-bit size.

CVE-2026-56002

A heap bufferflow in pcfReadFont() due to missing glyph bounds
checking.

CVE-2026-56003

A heap buffer overflow due to missing size checking in the property
buffer when parsing PCF files in ComputeScaledProperties().

For Debian 11 bullseye, these problems have been fixed in version
1:2.0.4-1+deb11u1.

For Debian 12 bookworm, these problems have been fixed in version
1:2.0.6-1+deb12u1.

We recommend that you upgrade your libxfont packages.

For the detailed security status of libxfont please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libxfont

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Severity
critical
Lowest
Low
Medium
High
Critical

Package: libxfont
Version: 1:2.0.4-1+deb11u1 1:2.0.6-1+deb12u1
CVE ID: CVE-2026-56001 CVE-2026-56002 CVE-2026-56003

Topics%20covered

Topics Covered

security advisory critical heap overflow libxfont authenticated access deblts

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.