CVE-2026-59679: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-59679 is an out-of-bounds read/write vulnerability in the libXfont2 font-server client, specifically within the fs_read_glyphs() function in src/fc/fserve.c. A remote attacker operating a malicious font server can exploit this flaw by sending mismatched num_extents and num_chars values, causing the client to access memory outside the bounds of the allocated encoding[] array. All versions of libXfont2 prior to 2.0.9 are affected. The vulnerability was discovered by independent security researcher Zhixi "Jace" Sun and publicly disclosed on August 5, 2026 via the oss-security mailing list. It carries a CVSS v3.1 base score of 7.5 (High) (Red Hat CVE, oss-security).

The root cause is an incomplete fix for CVE-2014-0210, classified as CWE-125 (Out-of-bounds Read) and CWE-787 (Out-of-bounds Write). In fs_read_glyphs(), the encoding[] array is allocated based on num_extents from the FS_QueryXExtents16 reply, but subsequently indexed using num_chars from the separate FS_QueryXBitmaps16 reply — and these two values are never cross-checked. A malicious font server can send a small num_extents (e.g., 1) followed by a large num_chars (e.g., 100,000), triggering out-of-bounds heap reads via NONZEROMETRICS(&encoding[minchar].metrics) and out-of-bounds heap pointer writes via encoding[minchar].bits = bits. Exploitation requires user interaction (connecting to a malicious font server) and operates over the network with high attack complexity (oss-security, Red Hat Bugzilla).

If the X server runs with root privileges, successful exploitation can lead to privilege escalation through heap memory corruption, potentially granting an attacker full system control. If the X server runs as an unprivileged user, exploitation results in a denial of service via process crash. The vulnerability exposes sensitive heap memory contents (confidentiality impact) and allows attacker-influenced writes to heap memory (integrity impact), with availability impact in all cases (oss-security, Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires high attack complexity, as the attacker must operate a malicious font server and induce a victim's X client to connect to it. The vulnerability has been detected by multiple vulnerability scanners including Nessus (plugin IDs 332110, 333157, 333259, 333509, 335922, 335961, 337648, 338018) and Qualys (IDs 764442, 764443) (Red Hat CVE, Red Hat Bugzilla).

1. Set up a malicious font server: The attacker configures a rogue X font server (xfs) that they control, capable of sending crafted protocol responses.
2. Induce client connection: The attacker tricks a victim's X server or X client into connecting to the malicious font server — for example, by manipulating the FontPath configuration or via social engineering.
3. Send crafted FS_QueryXExtents16 reply: The malicious server responds to a font query with a small num_extents value (e.g., 1), causing the client to allocate a small encoding[] heap buffer sized for only one entry.
4. Send crafted FS_QueryXBitmaps16 reply: The malicious server then sends a large num_chars value (e.g., 100,000) in the subsequent bitmap reply, which fs_read_glyphs() uses to index into the undersized encoding[] array without bounds checking.
5. Trigger out-of-bounds access: The client performs out-of-bounds heap reads via NONZEROMETRICS(&encoding[minchar].metrics) and out-of-bounds heap pointer writes via encoding[minchar].bits = bits, corrupting adjacent heap memory.
6. Achieve objective: If the X server runs as root, the attacker leverages heap corruption for privilege escalation; if unprivileged, the process crashes causing denial of service (oss-security, Red Hat Bugzilla).

• Network: Unexpected outbound connections from X server processes to unknown or external font server IP addresses/ports (default xfs port: TCP 7100); connections to font servers not listed in the authorized FontPath configuration.
• Logs: X server logs (/var/log/Xorg.0.log) showing connections to unfamiliar font servers; segmentation fault or crash entries related to the X server process; kernel logs (dmesg) showing heap corruption or memory access violations.
• Process: Unexpected crashes or restarts of the X server (Xorg) process; unusual child processes spawned from the X server after font server interaction.
• File System: Core dump files (core.*) generated by the X server process in unexpected locations, potentially containing heap memory artifacts useful for forensic analysis.

The upstream fix is available in libXfont2 version 2.0.9, which adds cross-validation between num_extents and num_chars values before indexing the encoding[] array (oss-security). Red Hat has issued patches for RHEL 8 (RHSA-2026:55446), RHEL 9 (RHSA-2026:55447), and RHEL 10 (RHSA-2026:55448); SUSE, openSUSE, Fedora, Slackware, Debian, AlmaLinux, and FreeBSD have also released updated packages (Red Hat Bugzilla). As interim workarounds: restrict network access to font servers to trusted clients only using firewall rules, remove external font server entries from the X server FontPath configuration, and disable font server functionality entirely if not required.

The vulnerability was publicly disclosed by X.Org via the oss-security mailing list on August 5, 2026, with Peter Hutterer forwarding the official X.Org Security Advisory (oss-security). The advisory noted that the flaw is caused by an incomplete fix of the decade-old CVE-2014-0210, highlighting the challenge of fully remediating complex memory management bugs in legacy X11 code. Multiple Linux distributions responded promptly with security updates within days of disclosure, and the vulnerability received coverage from Linux security news outlets including linuxsecurity.com and pro-linux.de.