High severity · published Jul 8, 2026
CVE-2026-56001
libXfont2 BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow
8.8
CVSS
0.4%
EPSS
No
On KEV
Description
A heap buffer overflow in BitmapScaleBitmaps in libXfont2 before 2.0.8 due to an overflowing 32bit size could be used by attackers able to access the X Server to execute code within the X server cont
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
libXfont2 · X.Org
before 2.0.8 · source: vendor
LI
Libxfont · X
2.0.0 before 2.0.8 · source: NVD
In the news
VulnerabilityHigh
ZDI-26-406: X.Org Server BitmapScaleBitmaps Integer Overflow Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of X.Org Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-56001.
Jul 15, 2026·Zero Day Initiative
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-56001
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-56001
Patch
https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit/be0b08e2d354138d3222b4490e2a77c6ee42f778
Mailing List
https://www.openwall.com/lists/oss-security/2026/07/08/1
More from libXfont2
8.8
CVE-2026-56003
libXfont2 computeProps Property Buffer Heap Buffer Overflow
8.8
CVE-2026-56002
libXfont2 PCF Font Parsing Heap Buffer Overflow