CVE-2026-56002 libXfont2 PCF Font Parsing Heap Buffer Overflow

A heap bufferflow in pcfReadFont due to missing glyph bounds checking in libXfont2 before 2.0.8 allows attackers authenticated as X client to execute code within the X server...

CVE-2026-56002

A heap bufferflow in pcfReadFont due to missing glyph bounds checking in libXfont2 before 2.0.8 allows attackers authenticated as X client to execute code within the X server...

CVE-2026-56002 libXfont2 PCF Font Parsing Heap Buffer Overflow

A heap bufferflow in pcfReadFont due to missing glyph bounds checking in libXfont2 before 2.0.8 allows attackers authenticated as X client to execute code within the X server...

Security update for libXfont2

This update for libXfont2 fixes the following issues CVE-2026-56001: integer overflow in BitmapScaleBitmaps can lead to a heap buffer overflow bsc1269018. CVE-2026-56002: insufficient checks in pcfReadFont can lead to a heap buffer overflow bsc1269019. CVE-2026-56003: missing bounds check in...

Security update for xorg-x11-server

This update for xorg-x11-server fixes the following issue CVE-2026-55999: missing bounds check in glamorfontget can lead to a heap buffer overflow when a font loaded from a malicious PCF file is processed bsc1268893. Patch Instructions: To install this SUSE update use the SUSE recommended...

Security update for xorg-x11-server

This update for xorg-x11-server fixes the following issues CVE-2026-55999: missing bounds check in glamorfontget can lead to a heap buffer overflow when a font loaded from a malicious PCF file is processed bsc1268893. CVE-2026-56000: improper memory management in CommonMakeCurrent can lead to a...

SUSE-SU-2026:2788-1 Security update for xorg-x11-server

This update for xorg-x11-server fixes the following issues - CVE-2026-55999: missing bounds check in glamorfontget can lead to a heap buffer overflow when a font loaded from a malicious PCF file is processed bsc1268893. - CVE-2026-56000: improper memory management in CommonMakeCurrent can lead to...

Security update for xwayland

This update for xwayland fixes the following issues CVE-2026-55999: missing bounds check in glamorfontget can lead to a heap buffer overflow when a font loaded from a malicious PCF file is processed bsc1268893. CVE-2026-56000: improper memory management in CommonMakeCurrent can lead to a heap...

PT-2026-56390

Name of the Vulnerable Software and Affected Versions libXfont2 versions prior to 2.0.8 Description A heap bufferflow occurs in the pcfReadFont function due to missing glyph bounds checking. This allows an authenticated X client to execute arbitrary code within the X server. Recommendations Updat...

PT-2026-56391

Name of the Vulnerable Software and Affected Versions libXfont2 versions prior to 2.0.8 Description A heap buffer overflow occurs when parsing PCF files due to missing size checking in the property buffer within the ComputeScaledProperties function. Authenticated X clients can exploit this issue ...

Linux Distros Unpatched Vulnerability : CVE-2026-56003

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2 ComputeScaledProperties before libXfont2 before...

SUSE CVE-2026-54059

Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py loadbitmaps read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes without calling Image.decompressionbombcheck, allowing crafted PCF font data to cause excessive memory allocation. Thi...

CVE-2026-54059

A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing specially crafted PCF font data. This data, when processed, can lead to excessive memory allocation because the library does not properly check for decompression bombs. The primar...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the PcfFontFile.loadbitmaps process. An attacker can cause excessive memory allocation by supplying crafted PCF font data that bypasses decompression bomb checks. Remediation Upgrade pillo...

PYSEC-2026-2253

Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py loadbitmaps read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes without calling Image.decompressionbombcheck, allowing crafted PCF font data to cause excessive memory allocation. Thi...

CVE-2026-54059

Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py loadbitmaps read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes without calling Image.decompressionbombcheck, allowing crafted PCF font data to cause excessive memory allocation. Thi...

CVE-2026-54059

Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py loadbitmaps read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes without calling Image.decompressionbombcheck, allowing crafted PCF font data to cause excessive memory allocation. Thi...

CVE-2026-54059 Pillow: PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading

Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py loadbitmaps read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes without calling Image.decompressionbombcheck, allowing crafted PCF font data to cause excessive memory allocation. Thi...

CVE-2026-54059 Pillow: PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading

Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py loadbitmaps read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes without calling Image.decompressionbombcheck, allowing crafted PCF font data to cause excessive memory allocation. Thi...

PT-2026-55962

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 12.3.0 Description In the load bitmaps function within PIL/PcfFontFile.py, glyph dimensions are read from the PCF METRICS section and passed to Image.frombytes without invoking Image. decompression bomb check. This...