A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8 allows attackers authenticated as X client to execute code within the X server.

freebsd 9a1fdf39-7b10-11f1-a315-589cfc10a551: libXfont2 -- Multiple vulnerabilities

The version of libXfont2 installed on the remote host is prior to 2.0.8. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2026-189-01 advisory.

    New libXfont2 packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the libXfont2 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A heap buffer overflow in BitmapScaleBitmaps in libXfont2 before 2.0.8 due to an overflowing 32bit size
    could be used by attackers able to access the X Server to execute code within the X server cont
    (CVE-2026-56001)

  - A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8 allows
    attackers authenticated as X client to execute code within the X server. (CVE-2026-56002)

  - A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in
    libXfont2 ComputeScaledProperties() before libXfont2 before 2.0.8 could be used by attackers using
    authenticated X clients to execute code within the X server. (CVE-2026-56003)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8 allows     attackers authenticated as X client to execute code within the X server. (CVE-2026-56002)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
325792	Slackware Linux 15.0 / current libXfont2 Multiple Vulnerabilities (SSA:2026-189-01)	Nessus	Slackware Local Security Checks	high
444517	Alpine: multiple libxfont2 packages: security update to 2.0.8-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
444517	Alpine: multiple libxfont2 packages: security update to 2.0.8-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
325692	Linux Distros Unpatched Vulnerability : CVE-2026-56002	Nessus	Misc.	high

Detections

Analytics

CVE-2026-56002

high

Tenable Plugins

Coming Soon

high

high

high

high