Security Feed
See the latest insights and analysis from our MDR team.
RSS for SlackCVE-2026-44950, CVE-2026-59679
By Roy Kalfon |
10 September 2026
CVE-2026-44950, CVE-2026-59679 – libXfont2 font-server client glyph parsing flaws allow remote heap overflows
libXfont2 fs_read_glyphs() mishandles font server replies, enabling remote heap OOB writes/reads. CVE-2026-44950 overflows the destination buffer via overlapping glyph bitmap slices that cumulatively exceed allocation. CVE-2026-59679 trusts mismatched num_extents vs num_chars, indexing encoding[] out of bounds. Patch libXfont2 to >=2.0.3-150000.3.6.1 in affected SUSE images/containers.