CVE-2026-56002 libXfont2 PCF Font Parsing Heap Buffer Overflow

High 8.5 Published 8 Jul 2026 Updated 9 Jul 2026

Authenticated X clients can execute arbitrary code in the X server via a heap buffer overflow in libXfont2's PCF font parser.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-56002?

CVE-2026-56002 is a high-severity memory corruption vulnerability in X.Org libXfont2, published on 8 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8 allows attackers authenticated as X client to execute code within the X server.

Weakness: CWE-122

Which versions are affected by CVE-2026-56002?

It affects 1 product.

Products include X Libxfont.

How do I fix CVE-2026-56002?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-56002 being exploited?

There is no known exploitation of CVE-2026-56002 in the wild and no public exploit code.

Sources

Also known as AZL-92087, BELL-CVE-2026-56002, DEBIAN-CVE-2026-56002, ECHO-4e4f-e6d6-0780, GHSA-r49w-hq6h-2w8q, UBUNTU-CVE-2026-56002.