CVE-2026-84524: Out-of-bounds Read

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted font file may lead to unexpected...

PT-2026-91646

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted font may result in the disclosure of process memory...

PT-2026-91588

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted font file may lead to unexpected...

PT-2026-91647

An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted font may result in the disclosure of process memory...

CVE-2026-84596: Out-of-bounds Read

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted font may result in the disclosure of process memory...

CVE-2026-84597: Out-of-bounds Read

An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted font may result in the disclosure of process memory...

ROS-20260911-73-0172

The vulnerability of the Font component in Google Chrome’s Linux operating system lies in the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code using a specially created HTML page...

ROS-20260911-73-0074

The vulnerability of the Font component in Google Chrome and Microsoft Edge relates to errors in HTTP request processing. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-79591

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap-buffer-overflow and use-after-free vulnerability exists in the xlsgetCSS function of libxls 1.6.3 due to insufficient validation of a file-controlled fon...

CVE-2026-79591

A heap-buffer-overflow and use-after-free vulnerability exists in the xlsgetCSS function of libxls 1.6.3 due to insufficient validation of a file-controlled font index...

DEBIAN-CVE-2026-79591

A heap-buffer-overflow and use-after-free vulnerability exists in the xlsgetCSS function of libxls 1.6.3 due to insufficient validation of a file-controlled font index...

CVE-2026-79591

A heap-buffer-overflow and use-after-free vulnerability exists in the xlsgetCSS function of libxls 1.6.3 due to insufficient validation of a file-controlled font index...

UBUNTU-CVE-2026-79591

A heap-buffer-overflow and use-after-free vulnerability exists in the xlsgetCSS function of libxls 1.6.3 due to insufficient validation of a file-controlled font index...

@eigenpal/docx-editor-react: CSS injection and print-time XSS via unescaped embedded font-family name

Summary Embedded font-family names word/fontTable.xml were interpolated unescaped into an injected @font-face and into the print window's document.write. A crafted name injects page-wide CSS on open, and breaks out of into executable HTML on Print. Impact Opening a crafted .docx applies...

CVE-2026-59679

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...

CVE-2026-44950

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice position, length lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the...

AZL-101730 CVE-2026-59679 affecting package libXfont2 for versions less than 2.0.9-1

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...

AZL-101733 CVE-2026-44950 affecting package libXfont2 for versions less than 2.0.9-1

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice position, length lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the...

UBUNTU-CVE-2026-59679

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...

CVE-2026-44950

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice position, length lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the...