Heap buffer overflow in libXfont2 fs_read_glyphs()
CVE-2026-44950 Published on September 10, 2026

fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow in libXfont2
fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice (position, length) lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the allocation. A malicious font server can send overlapping source offsets -- for example 1000 glyphs each referencing {position:0, length:64} with nbytes=64. Each individual source range passes the existing validation, but the cumulative writes total 64000 bytes into a 64-byte destination buffer. This is a heap buffer overflow with attacker-controlled content.

NVD

Vulnerability Analysis

CVE-2026-44950 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.

Attack Vector:

NETWORK

Attack Complexity:

HIGH

Privileges Required:

NONE

User Interaction:

NONE

Scope:

CHANGED

Confidentiality Impact:

HIGH

Integrity Impact:

HIGH

Availability Impact:

HIGH

Products Associated with CVE-2026-44950

Want to know whenever a new CVE is published for Suse products? stack.watch will email you.

Suse Linux Enterprise Desktop

Suse Linux Enterprise

Suse Linux Enterprise Server

Suse Manager

Affected Versions

Container suse/kiosk/tigervnc-x11vnc:1.14-63.8:

Version ? and below 2.0.3-150000.3.6.1 is affected.

Container suse/kiosk/xorg:21.1-83.7:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Image SLES15-SP6-SAP:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Image SLES15-SP6-SAP-Azure:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Image SLES15-SP6-SAP-Azure-3P:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Image SLES15-SP6-SAP-BYOS:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Image SLES15-SP6-SAP-BYOS-Azure:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Image SLES15-SP6-SAP-BYOS-EC2:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Image SLES15-SP6-SAP-BYOS-GCE:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Image SLES15-SP6-SAP-EC2:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Image SLES15-SP6-SAP-GCE:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Image SLES15-SP6-SAP-Hardened:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Image SLES15-SP6-SAP-Hardened-Azure:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Image SLES15-SP6-SAP-Hardened-BYOS:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Image SLES15-SP6-SAP-Hardened-BYOS-Azure:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Image SLES15-SP6-SAP-Hardened-BYOS-EC2:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Image SLES15-SP6-SAP-Hardened-BYOS-GCE:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Image SLES15-SP6-SAP-Hardened-EC2:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Image SLES15-SP6-SAP-Hardened-GCE:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Image SLES15-SP6-SAPCAL:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Image SLES15-SP6-SAPCAL-Azure:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Image SLES15-SP6-SAPCAL-EC2:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Image SLES15-SP6-SAPCAL-GCE:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Image SLES15-SP7-SAP-Azure:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Image SLES15-SP7-SAP-Azure-3P:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Image SLES15-SP7-SAP-BYOS-Azure:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Image SLES15-SP7-SAP-BYOS-EC2:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Image SLES15-SP7-SAP-BYOS-GCE:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Image SLES15-SP7-SAP-EC2:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Image SLES15-SP7-SAP-GCE:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Image SLES15-SP7-SAP-GCE-3P:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Image SLES15-SP7-SAP-Hardened-Azure:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Image SLES15-SP7-SAP-Hardened-BYOS-Azure:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Image SLES15-SP7-SAP-Hardened-BYOS-EC2:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Image SLES15-SP7-SAP-Hardened-BYOS-GCE:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Image SLES15-SP7-SAP-Hardened-GCE:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Image SLES15-SP7-SAPCAL-Azure:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Image SLES15-SP7-SAPCAL-EC2:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Image SLES15-SP7-SAPCAL-GCE:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Image SLES-SAP-Azure:

Version ? and below 2.0.7-160000.5.1 is affected.

SUSE Image SLES-SAP-Azure-3P:

Version ? and below 2.0.7-160000.5.1 is affected.

SUSE Image SLES-SAP-BYOS-Azure:

Version ? and below 2.0.7-160000.5.1 is affected.

SUSE Image SLES-SAP-BYOS-EC2:

Version ? and below 2.0.7-160000.5.1 is affected.

SUSE Image SLES-SAP-BYOS-GCE:

Version ? and below 2.0.7-160000.5.1 is affected.

SUSE Image SLES-SAP-GCE:

Version ? and below 2.0.7-160000.5.1 is affected.

SUSE Image SLES-SAP-GCE-3P:

Version ? and below 2.0.7-160000.5.1 is affected.

SUSE Image SLES-SAPCAL-GCE:

Version ? and below 2.0.7-160000.5.1 is affected.

SUSE Image SLES12-SP5-Azure-SAP-BYOS:

Version ? and below 2.0.3-3.6.1 is affected.

SUSE Image SLES12-SP5-Azure-SAP-On-Demand:

Version ? and below 2.0.3-3.6.1 is affected.

SUSE Image SLES12-SP5-EC2-SAP-BYOS:

Version ? and below 2.0.3-3.6.1 is affected.

SUSE Image SLES12-SP5-EC2-SAP-On-Demand:

Version ? and below 2.0.3-3.6.1 is affected.

SUSE Image SLES12-SP5-GCE-SAP-BYOS:

Version ? and below 2.0.3-3.6.1 is affected.

SUSE Image SLES12-SP5-GCE-SAP-On-Demand:

Version ? and below 2.0.3-3.6.1 is affected.

SUSE Liberty Linux 10:

Version ? and below 2.0.6-5.el10_2.3 is affected.

SUSE Liberty Linux 10:

Version ? and below 2.0.6-5.el10_2.3 is affected.

SUSE Liberty Linux 8:

Version ? and below 2.0.3-2.el8_10.3 is affected.

SUSE Liberty Linux 8:

Version ? and below 2.0.3-2.el8_10.3 is affected.

SUSE Liberty Linux 9:

Version ? and below 2.0.3-12.el9_8.3 is affected.

SUSE Liberty Linux 9:

Version ? and below 2.0.3-12.el9_8.3 is affected.

SUSE Linux Enterprise Desktop 15 SP7:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Linux Enterprise Desktop 15 SP7:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Linux Enterprise Module for Basesystem 15 SP7:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Linux Enterprise Module for Basesystem 15 SP7:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Linux Enterprise Server 15 SP7:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Linux Enterprise Server 15 SP7:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Linux Enterprise Server for SAP Applications 15 SP7:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Linux Enterprise Server for SAP Applications 15 SP7:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Linux Enterprise Server 12 SP5-LTSS:

Version ? and below 2.0.3-3.6.1 is affected.

SUSE Linux Enterprise Server 15 SP4-LTSS:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Linux Enterprise Server 15 SP4-LTSS:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Linux Enterprise Server 15 SP5-LTSS:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Linux Enterprise Server 15 SP5-LTSS:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Linux Enterprise Server 15 SP6-LTSS:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Linux Enterprise Server 15 SP6-LTSS:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Linux Enterprise Server 16.0:

Version ? and below 2.0.7-160000.5.1 is affected.

SUSE Linux Enterprise Server 16.0:

Version ? and below 2.0.7-160000.5.1 is affected.

SUSE Linux Enterprise Server for SAP applications 16.0:

Version ? and below 2.0.7-160000.5.1 is affected.

SUSE Linux Enterprise Server for SAP applications 16.0:

Version ? and below 2.0.7-160000.5.1 is affected.

SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:

Version ? and below 2.0.3-3.6.1 is affected.

SUSE Linux Enterprise Server for SAP Applications 15 SP4:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Linux Enterprise Server for SAP Applications 15 SP4:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Linux Enterprise Server for SAP Applications 15 SP5:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Linux Enterprise Server for SAP Applications 15 SP5:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Linux Enterprise Server for SAP Applications 15 SP6:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Linux Enterprise Server for SAP Applications 15 SP6:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Manager Proxy LTS 4.3:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Manager Proxy LTS 4.3:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Manager Retail Branch Server LTS 4.3:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Manager Retail Branch Server LTS 4.3:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Manager Server LTS 4.3:

Version ? and below 2.0.3-150000.3.6.1 is affected.

SUSE Manager Server LTS 4.3:

Version ? and below 2.0.3-150000.3.6.1 is affected.

openSUSE Leap 16.0:

Version ? and below 2.0.7-160000.5.1 is affected.

openSUSE Leap 16.0:

Version ? and below 2.0.7-160000.5.1 is affected.

openSUSE Tumbleweed:

Version ? and below 2.0.7-3.1 is affected.

openSUSE Tumbleweed:

Version ? and below 2.0.7-3.1 is affected.

openSUSE Tumbleweed:

Version ? and below 2.0.7-3.1 is affected.

openSUSE Tumbleweed:

Version ? and below 2.0.7-3.1 is affected.

libXfont:

Version ?, <= 2.0.8 is affected.

Heap buffer overflow in libXfont2 fs_read_glyphs()CVE-2026-44950 Published on September 10, 2026

Vulnerability Analysis

Products Associated with CVE-2026-44950

Affected Versions

Heap buffer overflow in libXfont2 fs_read_glyphs()
CVE-2026-44950 Published on September 10, 2026