PatchTheCVElibxfont vulnerabilities and fixes
Recent CVEs affecting libxfont, with upgrade or downgrade steps. 3 tracked.
libxfont has 3 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 3. Most recent: 2026-07-08. Highest priority: CVE-2026-56002 (score 39/100).
- CVE-2026-56002 HIGH 8.5 UPGRADE A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8 allows atta
- CVE-2026-56001 HIGH 8.5 UPGRADE A heap buffer overflow in BitmapScaleBitmaps in libXfont2 before 2.0.8 due to an overflowing 32bit size could
- CVE-2026-56003 HIGH 8.5 UPGRADE A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2
FAQ
How do I fix libxfont vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is libxfont being exploited right now?
None of the tracked libxfont CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which libxfont CVE should I patch first?
CVE-2026-56002 currently ranks highest (39/100): A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8 allows atta.