A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8 allows attackers authenticated as X client to execute code within the X server.
{
"cna_assigner": "suse",
"cwe_ids": [
"CWE-122"
],
"unresolved_ranges": [
{
"source": "AFFECTED_FIELD",
"extracted_events": [
{
"fixed": "2.0.8"
}
]
},
{
"source": "CPE_FIELD",
"extracted_events": [
{
"fixed": "2.0.8"
}
]
},
{
"source": "DESCRIPTION",
"extracted_events": [
{
"introduced": "libXfont2"
},
{
"fixed": "2.0.8"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56002.json"
}