CVE-2026-123785

Fluxbox through 1.3.7 contains an infinite loop vulnerability in Menu::updateMenu in src/FbTk/Menu.cc that allows attackers to hang the window manager via crafted style geometry values. Attackers can supply a style with an oversized unbounded menu.titleHeight so the column loop never terminates,...

CVE-2026-123785

Fluxbox versions through 1.3.7 are vulnerable to an infinite loop within the Menu::updateMenu() function located in src/FbTk/Menu.cc. An attacker can cause a denial of service (DoS) at startup by providing crafted style geometry values, specifically an oversized and unbounded menu.titleHeight. Th...

EUVD-2026-118303

Fluxbox through 1.3.7 contains an infinite loop vulnerability in Menu::updateMenu in src/FbTk/Menu.cc that allows attackers to hang the window manager via crafted style geometry values. Attackers can supply a style with an oversized unbounded menu.titleHeight so the column loop never terminates,...

CVE-2026-123785 Fluxbox through 1.3.7 Infinite Loop via Menu::updateMenu() Style Geometry

Fluxbox through 1.3.7 contains an infinite loop vulnerability in Menu::updateMenu in src/FbTk/Menu.cc that allows attackers to hang the window manager via crafted style geometry values. Attackers can supply a style with an oversized unbounded menu.titleHeight so the column loop never terminates,...

CVE-2026-123785: fluxbox: Fluxbox through 1.3.7 contains an infinite loop vulnerability in Menu::updateMenu() in src/FbTk/Menu.cc that allows…

Fluxbox through 1.3.7 contains an infinite loop vulnerability in Menu::updateMenu in src/FbTk/Menu.cc that allows attackers to hang the window manager via crafted style geometry values. Attackers can supply a style with an oversized unbounded menu.titleHeight so the column loop never terminates,...