CVE-2026-59679
Critical
Description
fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a size derived from num_extents in the separate FS_QueryXExtents16 reply. The two CARD32 fields are never cross-checked. A malicious or compromised font server can send a small num_extents (e.g. 1) in the extents reply, then a large num_chars (e.g. 100000) in the bitmaps reply. This causes attacker-controlled out-of-bounds heap read and writes.
SeverityCritical
CVSS9.0
Exploit probability—
Product
libXfont2
PublishedSep 10, 2026
First seenSep 10, 2026
Weakness typeCWE-787Out-of-bounds write
How to fix
Update
- SUSE Container suse/kiosk/tigervnc-x11vnc:1.14-63.82.0.3-150000.3.6.1 or later
- SUSE Container suse/kiosk/xorg:21.1-83.72.0.3-150000.3.6.1 or later
- SUSE Image SLES15-SP6-SAP2.0.3-150000.3.6.1 or later
- SUSE Image SLES15-SP6-SAP-Azure2.0.3-150000.3.6.1 or later
- SUSE Image SLES15-SP6-SAP-Azure-3P2.0.3-150000.3.6.1 or later
- SUSE Image SLES15-SP6-SAP-BYOS2.0.3-150000.3.6.1 or later
- SUSE Image SLES15-SP6-SAP-BYOS-Azure2.0.3-150000.3.6.1 or later
- SUSE Image SLES15-SP6-SAP-BYOS-EC22.0.3-150000.3.6.1 or later
- SUSE Image SLES15-SP6-SAP-BYOS-GCE2.0.3-150000.3.6.1 or later
- SUSE Image SLES15-SP6-SAP-EC22.0.3-150000.3.6.1 or later
- SUSE Image SLES15-SP6-SAP-GCE2.0.3-150000.3.6.1 or later
- SUSE Image SLES15-SP6-SAP-Hardened2.0.3-150000.3.6.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| libXfont2 libXfont2 | ? ≤ v ≤ 2.0.8 | — |
| SUSE Container suse/kiosk/tigervnc-x11vnc:1.14-63.8 | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE Container suse/kiosk/xorg:21.1-83.7 | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE Image SLES15-SP6-SAP | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE Image SLES15-SP6-SAP-Azure | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE Image SLES15-SP6-SAP-Azure-3P | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE Image SLES15-SP6-SAP-BYOS | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE Image SLES15-SP6-SAP-BYOS-Azure | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE Image SLES15-SP6-SAP-BYOS-EC2 | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE Image SLES15-SP6-SAP-BYOS-GCE | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE Image SLES15-SP6-SAP-EC2 | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE Image SLES15-SP6-SAP-GCE | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE Image SLES15-SP6-SAP-Hardened | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE Image SLES15-SP6-SAP-Hardened-Azure | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE Image SLES15-SP6-SAP-Hardened-BYOS | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE Image SLES15-SP6-SAP-Hardened-BYOS-Azure | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE Image SLES15-SP6-SAP-Hardened-BYOS-EC2 | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE Image SLES15-SP6-SAP-Hardened-BYOS-GCE | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE Image SLES15-SP6-SAP-Hardened-EC2 | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE Image SLES15-SP6-SAP-Hardened-GCE | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE Image SLES15-SP6-SAPCAL | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE Image SLES15-SP6-SAPCAL-Azure | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE Image SLES15-SP6-SAPCAL-EC2 | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE Image SLES15-SP6-SAPCAL-GCE | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE Image SLES15-SP7-SAP-Azure | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE Image SLES15-SP7-SAP-Azure-3P | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE Image SLES15-SP7-SAP-BYOS-Azure | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE Image SLES15-SP7-SAP-BYOS-EC2 | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE Image SLES15-SP7-SAP-BYOS-GCE | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE Image SLES15-SP7-SAP-EC2 | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE Image SLES15-SP7-SAP-GCE | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE Image SLES15-SP7-SAP-GCE-3P | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE Image SLES15-SP7-SAP-Hardened-Azure | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE Image SLES15-SP7-SAP-Hardened-BYOS-Azure | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE Image SLES15-SP7-SAP-Hardened-BYOS-EC2 | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE Image SLES15-SP7-SAP-Hardened-BYOS-GCE | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE Image SLES15-SP7-SAP-Hardened-GCE | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE Image SLES15-SP7-SAPCAL-Azure | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE Image SLES15-SP7-SAPCAL-EC2 | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE Image SLES15-SP7-SAPCAL-GCE | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE Image SLES-SAP-Azure | ? ≤ v < 2.0.7-160000.5.1 | 2.0.7-160000.5.1 |
| SUSE Image SLES-SAP-Azure-3P | ? ≤ v < 2.0.7-160000.5.1 | 2.0.7-160000.5.1 |
| SUSE Image SLES-SAP-BYOS-Azure | ? ≤ v < 2.0.7-160000.5.1 | 2.0.7-160000.5.1 |
| SUSE Image SLES-SAP-BYOS-EC2 | ? ≤ v < 2.0.7-160000.5.1 | 2.0.7-160000.5.1 |
| SUSE Image SLES-SAP-BYOS-GCE | ? ≤ v < 2.0.7-160000.5.1 | 2.0.7-160000.5.1 |
| SUSE Image SLES-SAP-GCE | ? ≤ v < 2.0.7-160000.5.1 | 2.0.7-160000.5.1 |
| SUSE Image SLES-SAP-GCE-3P | ? ≤ v < 2.0.7-160000.5.1 | 2.0.7-160000.5.1 |
| SUSE Image SLES-SAPCAL-GCE | ? ≤ v < 2.0.7-160000.5.1 | 2.0.7-160000.5.1 |
| SUSE Image SLES12-SP5-Azure-SAP-BYOS | ? ≤ v < 2.0.3-3.6.1 | 2.0.3-3.6.1 |
| SUSE Image SLES12-SP5-Azure-SAP-On-Demand | ? ≤ v < 2.0.3-3.6.1 | 2.0.3-3.6.1 |
| SUSE Image SLES12-SP5-EC2-SAP-BYOS | ? ≤ v < 2.0.3-3.6.1 | 2.0.3-3.6.1 |
| SUSE Image SLES12-SP5-EC2-SAP-On-Demand | ? ≤ v < 2.0.3-3.6.1 | 2.0.3-3.6.1 |
| SUSE Image SLES12-SP5-GCE-SAP-BYOS | ? ≤ v < 2.0.3-3.6.1 | 2.0.3-3.6.1 |
| SUSE Image SLES12-SP5-GCE-SAP-On-Demand | ? ≤ v < 2.0.3-3.6.1 | 2.0.3-3.6.1 |
| SUSE SUSE Liberty Linux 10 | ? ≤ v < 2.0.6-5.el10_2.3 | 2.0.6-5.el10_2.3 |
| SUSE SUSE Liberty Linux 8 | ? ≤ v < 2.0.3-2.el8_10.3 | 2.0.3-2.el8_10.3 |
| SUSE SUSE Liberty Linux 9 | ? ≤ v < 2.0.3-12.el9_8.3 | 2.0.3-12.el9_8.3 |
| SUSE SUSE Linux Enterprise Desktop 15 SP7 | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE SUSE Linux Enterprise Module for Basesystem 15 SP7 | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE SUSE Linux Enterprise Server 15 SP7 | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP7 | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE SUSE Linux Enterprise Server 12 SP5-LTSS | ? ≤ v < 2.0.3-3.6.1 | 2.0.3-3.6.1 |
| SUSE SUSE Linux Enterprise Server 15 SP4-LTSS | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE SUSE Linux Enterprise Server 15 SP5-LTSS | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE SUSE Linux Enterprise Server 15 SP6-LTSS | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE SUSE Linux Enterprise Server 16.0 | ? ≤ v < 2.0.7-160000.5.1 | 2.0.7-160000.5.1 |
| SUSE SUSE Linux Enterprise Server for SAP applications 16.0 | ? ≤ v < 2.0.7-160000.5.1 | 2.0.7-160000.5.1 |
| SUSE SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | ? ≤ v < 2.0.3-3.6.1 | 2.0.3-3.6.1 |
| SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP4 | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP5 | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP6 | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE SUSE Manager Proxy LTS 4.3 | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE SUSE Manager Retail Branch Server LTS 4.3 | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE SUSE Manager Server LTS 4.3 | ? ≤ v < 2.0.3-150000.3.6.1 | 2.0.3-150000.3.6.1 |
| SUSE openSUSE Leap 16.0 | ? ≤ v < 2.0.7-160000.5.1 | 2.0.7-160000.5.1 |
| SUSE openSUSE Tumbleweed | ? ≤ v < 2.0.7-3.1 | 2.0.7-3.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.