A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8 allows attackers authenticated as X client to execute code within the X server.

rocky_linux RLSA-2026:47079: RLSA-2026:47079: libXfont2 security update (Important)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:47103 advisory.

    * libXfont2: BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow (CVE-2026-56001)

    * libXfont2: PCF Font Parsing Heap Buffer Overflow (CVE-2026-56002)

    * libXfont2: computeProps Property Buffer Heap Buffer Overflow (CVE-2026-56003)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-47103 advisory.

    [2.0.3-2.1]
    - CVE fix for: CVE-2026-56001, CVE-2026-56002, CVE-2026-56003       Resolves: https://redhat.atlassian.net/browse/RHEL-191877       Resolves: https://redhat.atlassian.net/browse/RHEL-191928       Resolves: https://redhat.atlassian.net/browse/RHEL-191948

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-47084 advisory.

    [2.0.3-12.1]
    - CVE fix for: CVE-2026-56001, CVE-2026-56002, CVE-2026-56003       Resolves: https://redhat.atlassian.net/browse/RHEL-191886       Resolves: https://redhat.atlassian.net/browse/RHEL-191933       Resolves: https://redhat.atlassian.net/browse/RHEL-191938

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-47079 advisory.

    [2.0.6-5.1]
    - CVE fix for: CVE-2026-56001, CVE-2026-56002, CVE-2026-56003       Resolves: https://redhat.atlassian.net/browse/RHEL-191882       Resolves: https://redhat.atlassian.net/browse/RHEL-191930       Resolves: https://redhat.atlassian.net/browse/RHEL-191949

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:47103 advisory.

    X.Org X11 libXfont2 runtime library

    Security Fix(es):

    * libXfont2: BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow (CVE-2026-56001)

    * libXfont2: PCF Font Parsing Heap Buffer Overflow (CVE-2026-56002)

    * libXfont2: computeProps Property Buffer Heap Buffer Overflow (CVE-2026-56003)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:47079 advisory.

    X.Org X11 libXfont2 runtime library

    Security Fix(es):

    * libXfont2: BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow (CVE-2026-56001)

    * libXfont2: PCF Font Parsing Heap Buffer Overflow (CVE-2026-56002)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of libXfont installed on the remote host is prior to 1.5.4-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3815 advisory.

    BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow (CVE-2026-56001)

    PCF Font Parsing Heap Buffer Overflow (CVE-2026-56002)

    computeProps Property Buffer Heap Buffer Overflow (CVE-2026-56003)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of libXfont2 installed on the remote host is prior to 2.0.3-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3814 advisory.

    BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow (CVE-2026-56001)

    PCF Font Parsing Heap Buffer Overflow (CVE-2026-56002)

    computeProps Property Buffer Heap Buffer Overflow (CVE-2026-56003)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1967 advisory.

    BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow (CVE-2026-56001)

    PCF Font Parsing Heap Buffer Overflow (CVE-2026-56002)

    computeProps Property Buffer Heap Buffer Overflow (CVE-2026-56003)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0616 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-56003:
    A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in     libXfont2 ComputeScaledProperties() before libXfont2 before 2.0.8 could be used by attackers using     authenticated X clients to execute code within the X server.

    CVE-2026-56002:
    A heap bufferflow in pcfReadFont() due to missing glyph bounds checkingin libXfont2 before 2.0.8     allows attackers authenticated as X client to execute code within the X server.

    CVE-2026-56001:
    A heap buffer overflow in BitmapScaleBitmaps in libXfont2 before 2.0.8 due to an overflowing 32bit size     could be used by attackers able to access the X Server to execute code within the X server cont

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6388 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6388-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     July 15, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : libxfont     CVE ID         : CVE-2026-56001 CVE-2026-56002 CVE-2026-56003     Debian Bug     : 1141702

    Several vulnerabilities were discovered in libXfont, the X11 font     rasterisation library, which may result in arbitrary code execution in     the X server context for authenticated X clients.

    For the stable distribution (trixie), these problems have been fixed in     version 1:2.0.6-1+deb13u1.

    We recommend that you upgrade your libxfont packages.

    For the detailed security status of libxfont please refer to its     security tracker page at:
    https://security-tracker.debian.org/tracker/libxfont

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21284-1 advisory.

    This update for libXfont2 fixes the following issues

    - CVE-2026-56001: BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow (bsc#1269018).
    - CVE-2026-56002: PCF Font Parsing Heap Buffer Overflow (bsc#1269019).
    - CVE-2026-56003: computeProps Property Buffer Heap Buffer Overflow (bsc#1269020).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4678 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4678-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Andrej Shadura     July 12, 2026                                 https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : libxfont     Version        : 1:2.0.4-1+deb11u1 1:2.0.6-1+deb12u1     CVE ID         : CVE-2026-56001 CVE-2026-56002 CVE-2026-56003

    A series of heap overflows in bitmap/PCF parser code could be used by     authenticated attackers to execute code in the X server context.

    CVE-2026-56001

        A heap buffer overflow in BitmapScaleBitmaps in due to an overflowing         32-bit size.

    CVE-2026-56002

        A heap bufferflow in pcfReadFont() due to missing glyph bounds         checking.

    CVE-2026-56003

        A heap buffer overflow due to missing size checking in the property         buffer when parsing PCF files in ComputeScaledProperties().

    For Debian 11 bullseye, these problems have been fixed in version     1:2.0.4-1+deb11u1.

    For Debian 12 bookworm, these problems have been fixed in version     1:2.0.6-1+deb12u1.

    We recommend that you upgrade your libxfont packages.

    For the detailed security status of libxfont please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libxfont

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-18ea3f47f8 advisory.

    libXfont2 2.0.8 (CVE-2026-56001, CVE-2026-56002, CVE-2026-56003)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-43652cd5e8 advisory.

    libXfont2 2.0.8 (CVE-2026-56001, CVE-2026-56002, CVE-2026-56003)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2794-1 advisory.

    This update for libXfont2 fixes the following issues

    - CVE-2026-56001: integer overflow in `BitmapScaleBitmaps` can lead to a heap buffer overflow     (bsc#1269018).
    - CVE-2026-56002: insufficient checks in `pcfReadFont` can lead to a heap buffer overflow (bsc#1269019).
    - CVE-2026-56003: missing bounds check in `ComputeScaledProperties` can lead to a heap buffer overflow     (bsc#1269020).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2793-1 advisory.

    This update for libXfont2 fixes the following issues

    - CVE-2026-56001: integer overflow in `BitmapScaleBitmaps` can lead to a heap buffer overflow     (bsc#1269018).
    - CVE-2026-56002: insufficient checks in `pcfReadFont` can lead to a heap buffer overflow (bsc#1269019).
    - CVE-2026-56003: missing bounds check in `ComputeScaledProperties` can lead to a heap buffer overflow     (bsc#1269020).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 9a1fdf39-7b10-11f1-a315-589cfc10a551 advisory.

    X.Org project reports:
    Multiple issues have been found in the libXfont2 library published                  by X.Org for which we are releasing security fixes in libXfont2-2.0.8.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of libXfont2 installed on the remote host is prior to 2.0.8. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2026-189-01 advisory.

    New libXfont2 packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the libXfont2 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A heap buffer overflow in BitmapScaleBitmaps in libXfont2 before 2.0.8 due to an overflowing 32bit size
    could be used by attackers able to access the X Server to execute code within the X server cont
    (CVE-2026-56001)

  - A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8 allows
    attackers authenticated as X client to execute code within the X server. (CVE-2026-56002)

  - A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in
    libXfont2 ComputeScaledProperties() before libXfont2 before 2.0.8 could be used by attackers using
    authenticated X clients to execute code within the X server. (CVE-2026-56003)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8 allows     attackers authenticated as X client to execute code within the X server. (CVE-2026-56002)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
330623	RockyLinux 8 : libXfont2 (RLSA-2026:47103)	Nessus	Rocky Linux Local Security Checks	high
330616	Oracle Linux 8 : libXfont2 (ELSA-2026-47103)	Nessus	Oracle Linux Local Security Checks	high
330610	Oracle Linux 9 : libXfont2 (ELSA-2026-47084)	Nessus	Oracle Linux Local Security Checks	high
330605	Oracle Linux 10 : libXfont2 (ELSA-2026-47079)	Nessus	Oracle Linux Local Security Checks	high
330447	RHEL 8 : libXfont2 (RHSA-2026:47103)	Nessus	Red Hat Local Security Checks	high
330441	RHEL 10 : libXfont2 (RHSA-2026:47079)	Nessus	Red Hat Local Security Checks	high
328843	Amazon Linux 2 : libXfont, --advisory ALAS2-2026-3815 (ALAS-2026-3815)	Nessus	Amazon Linux Local Security Checks	high
328834	Amazon Linux 2 : libXfont2, --advisory ALAS2-2026-3814 (ALAS-2026-3814)	Nessus	Amazon Linux Local Security Checks	high
328464	Amazon Linux 2023 : libXfont2, libXfont2-devel (ALAS2023-2026-1967)	Nessus	Amazon Linux Local Security Checks	high
328421	TencentOS Server 4: libXfont2 (TSSA-2026:0616)	Nessus	Tencent Local Security Checks	high
326977	Debian dsa-6388 : libxfont-dev - security update	Nessus	Debian Local Security Checks	high
326679	openSUSE 16 Security Update : libXfont2 (openSUSE-SU-2026:21284-1)	Nessus	SuSE Local Security Checks	high
326438	Debian dla-4678 : libxfont-dev - security update	Nessus	Debian Local Security Checks	high
326402	Fedora 43 : libXfont2 (2026-18ea3f47f8)	Nessus	Fedora Local Security Checks	high
326104	Fedora 44 : libXfont2 (2026-43652cd5e8)	Nessus	Fedora Local Security Checks	high
326011	SUSE SLED15 / SLES15 Security Update : libXfont2 (SUSE-SU-2026:2794-1)	Nessus	SuSE Local Security Checks	high
326008	SUSE SLES12 Security Update : libXfont2 (SUSE-SU-2026:2793-1)	Nessus	SuSE Local Security Checks	high
325982	FreeBSD : libXfont2 -- Multiple vulnerabilities (9a1fdf39-7b10-11f1-a315-589cfc10a551)	Nessus	FreeBSD Local Security Checks	high
325792	Slackware Linux 15.0 / current libXfont2 Multiple Vulnerabilities (SSA:2026-189-01)	Nessus	Slackware Local Security Checks	high
444517	Alpine: multiple libxfont2 packages: security update to 2.0.8-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
444517	Alpine: multiple libxfont2 packages: security update to 2.0.8-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
325692	Linux Distros Unpatched Vulnerability : CVE-2026-56002	Nessus	Misc.	high

Detections

Analytics

CVE-2026-56002

high

Tenable Plugins

Coming Soon

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high