X.Org patches libXfont2 font client flaws that can escalate privileges

X.Org has released libXfont2 2.0.9 to fix two memory-safety bugs in its font-server client code. Both can be triggered by a malicious font server and, when the X server runs as root, may allow privilege escalation; otherwise they typically crash the process.

CVE-2026-59679 is an out-of-bounds read and write. The client sizes one array from an extents reply but later indexes it with a character count taken from a separate bitmaps reply, without checking that the two values agree. A hostile server can therefore supply a tiny extents count and a huge character count. X.Org notes this is an incomplete repair of the older CVE-2014-0210. Independent researcher Zhixi "Jace" Sun found the issue.

CVE-2026-44950 is a heap buffer overflow in the same glyph-reading path. Per-glyph checks confirm each source slice lies inside the received bitmap data, yet nothing ensures the cumulative copies stay inside the single destination buffer. Overlapping source ranges that individually pass validation can therefore write far past the end of the allocation.

Systems that still speak to untrusted font servers, or that run the X server with elevated privileges, should update promptly.