CVE-2026-56003 libXfont2 computeProps Property Buffer Heap Buffer Overflow

High 8.5 Published 8 Jul 2026 Updated 9 Jul 2026

Authenticated X clients can trigger a heap buffer overflow in libXfont2 to execute arbitrary code within the X server.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-56003?

CVE-2026-56003 is a high-severity memory corruption vulnerability in X.Org libXfont2, published on 8 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2 ComputeScaledProperties() before libXfont2 before 2.0.8 could be used by attackers using authenticated X clients to execute code within the X server.

Weakness: CWE-122

Which versions are affected by CVE-2026-56003?

It affects 1 product.

Products include X Libxfont.

How do I fix CVE-2026-56003?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-56003 being exploited?

There is no known exploitation of CVE-2026-56003 in the wild and no public exploit code.

Sources

Also known as AZL-92084, BELL-CVE-2026-56003, CLSA-2026-1784797098, CLSA-2026-1784797435, CLSA-2026-1784798270, CLSA-2026-1787393547 and 4 more.