libXfont2: PCF Font Parsing Heap Buffer Overflow

A flaw was found in libXfont2. A specially crafted PCF Portable Compiled Format font file, when processed by libXfont2, can lead to a buffer overflow. This occurs because the font parsing process does not properly validate the size of a bitmap buffer against the glyph metrics provided in the...

libXfont2: PCF Font Parsing Heap Buffer Overflow

A flaw was found in libXfont2. A specially crafted PCF Portable Compiled Format font file, when processed by libXfont2, can lead to a buffer overflow. This occurs because the font parsing process does not properly validate the size of a bitmap buffer against the glyph metrics provided in the...

libXfont2: BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow

A flaw was found in libXfont2. In the BitmapScaleBitmaps function, an integer overflow can occur when calculating the memory needed for font glyphs. This overflow leads to a heap buffer overflow, where a smaller-than-required memory buffer is allocated. A local attacker can exploit this by loadin...

CVE-2026-44950

A flaw was found in the libXfont2 font-server client. This heap buffer overflow vulnerability allows a malicious font server to send specially crafted glyph data. The fsreadglyphs function fails to properly validate the total size of the incoming data, leading to an overwrite of memory beyond the...

CVE-2026-67291

A heap out-of-bounds read vulnerability in FreeRDP allows an unauthenticated, malicious RDP server to cause a Denial of Service. By sending a specially crafted glyph fragment update, the server forces the client to read beyond its allocated memory, crashing the application. Mitigation To mitigate...

Security update for libXfont2

This update for libXfont2 fixes the following issues: CVE-2026-44950: fsreadglyphs heap buffer overflow via cumulative glyph data overflow bsc1272661. CVE-2026-59679: fsreadglyphs heap OOB read/write via encoding array index mismatch bsc1272660. Patch Instructions: To install this SUSE update use...

SUSE-SU-2026:3499-1 Security update for libXfont2

This update for libXfont2 fixes the following issues: - CVE-2026-44950: fsreadglyphs heap buffer overflow via cumulative glyph data overflow bsc1272661. - CVE-2026-59679: fsreadglyphs heap OOB read/write via encoding array index mismatch bsc1272660...

PT-2026-69024

Name of the Vulnerable Software and Affected Versions libXfont2 versions prior to 2.0.7-3.1 Description A heap buffer overflow occurs in the Font Server Client when handling cumulative glyph data. A heap buffer overflow is a memory corruption issue where a program writes more data to a...

libXfont2 -- multiple vulnerabilities

Zhixi "Jace" Sun, independent security researcher reports: CVE-2026-44950: Font Server Client Cumulative Glyph Data Heap Buffer Overflow CVE-2026-59679: Font Server Client encoding Out-Of-Bounds Read/Write...

xorg: X11: xserver: X.org: glamor Font Atlas Heap Buffer Overflow

A flaw was found in the glamorfontget function of the xorg-x11-server. This vulnerability, a heap buffer overflow, occurs when the server processes a specially crafted PCF font file where individual glyph metrics exceed the declared maximum bounds. An authenticated X client can exploit this by...

Important: freerdp

Issue Overview: Heap-buffer-overflow write in TS Gateway RPC fragment receive due to uncapped bindack maxxmitfrag On TS Gateway connections, rpc-maxrecvfrag is initialized to 0x0FF8 4088 and ReceiveFragment is allocated to that size. In rpcbind.c, the client assigns rpc-maxrecvfrag =...

Vulnerability of the functions update_process_glyph_fragments() and glyph_cache_fragment_put() in the libfreerdp/cache/glyph.c file of the RDP client FreeRDP, allowing a intruder to cause a service failure

The vulnerabilities of the updateprocessglyphfragments and glyphcachefragmentput functions in the libfreerdp/cache/glyph.c file of the RDP client FreeRDP involve reading beyond the permitted range of memory. Exploiting these vulnerabilities could allow a malicious actor to cause service failures...

SUSE CVE-2026-67291

FreeRDP before 3.29.0 affected versions = 3.28.0 contains a heap out-of-bounds read in updateprocessglyphfragments/glyphcachefragmentput in libfreerdp/cache/glyph.c. When handling a GLYPHFRAGMENTADD update, the code reads a one-byte server-controlled declared fragment size but does not verify it...

Linux Distros Unpatched Vulnerability : CVE-2026-67291

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.29.0 affected versions = 3.28.0 contains a heap out-of-bounds read in updateprocessglyphfragments/glyphcachefragmentput in...

CVE-2026-67291

FreeRDP before 3.29.0 affected versions = 3.28.0 contains a heap out-of-bounds read in updateprocessglyphfragments/glyphcachefragmentput in libfreerdp/cache/glyph.c. When handling a GLYPHFRAGMENTADD update, the code reads a one-byte server-controlled declared fragment size but does not verify it...

CVE-2026-67291

FreeRDP before 3.29.0 affected versions = 3.28.0 contains a heap out-of-bounds read in updateprocessglyphfragments/glyphcachefragmentput in libfreerdp/cache/glyph.c. When handling a GLYPHFRAGMENTADD update, the code reads a one-byte server-controlled declared fragment size but does not verify it...

UBUNTU-CVE-2026-67291

FreeRDP before 3.29.0 affected versions = 3.28.0 contains a heap out-of-bounds read in updateprocessglyphfragments/glyphcachefragmentput in libfreerdp/cache/glyph.c. When handling a GLYPHFRAGMENTADD update, the code reads a one-byte server-controlled declared fragment size but does not verify it...

CVE-2026-67291 FreeRDP before 3.29.0 Heap Out-of-Bounds Read via GLYPH_FRAGMENT_ADD

FreeRDP before 3.29.0 affected versions = 3.28.0 contains a heap out-of-bounds read in updateprocessglyphfragments/glyphcachefragmentput in libfreerdp/cache/glyph.c. When handling a GLYPHFRAGMENTADD update, the code reads a one-byte server-controlled declared fragment size but does not verify it...

CVE-2026-67291 FreeRDP before 3.29.0 Heap Out-of-Bounds Read via GLYPH_FRAGMENT_ADD

FreeRDP before 3.29.0 affected versions = 3.28.0 contains a heap out-of-bounds read in updateprocessglyphfragments/glyphcachefragmentput in libfreerdp/cache/glyph.c. When handling a GLYPHFRAGMENTADD update, the code reads a one-byte server-controlled declared fragment size but does not verify it...

CVE-2026-67291

FreeRDP before 3.29.0 affected versions = 3.28.0 contains a heap out-of-bounds read in updateprocessglyphfragments/glyphcachefragmentput in libfreerdp/cache/glyph.c. When handling a GLYPHFRAGMENTADD update, the code reads a one-byte server-controlled declared fragment size but does not verify it...