Vulnerability details
CVE-2026-59679
SUSE Container suse/kiosk/tigervnc-x11vncSUSE Container suse/kiosk/xorgSUSE Image SLES-SAP-AzureSUSE Image SLES-SAP-Azure-3PSUSE Image SLES-SAP-BYOS-AzureSUSE Image SLES-SAP-BYOS-EC2
fs_read_glyphs() heap OOB read/write via encoding array index mismatch in libXfont2
CVSS 4.0
9.2Critical
Official description
fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a size derived from num_extents in the separate FS_QueryXExtents16 reply. The two CARD32 fields are never cross-checked. A malicious or compromised font server can send a small num_extents (e.g. 1) in the extents reply, then a large num_chars (e.g. 100000) in the bitmaps reply. This causes attacker-controlled out-of-bounds heap read and writes.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.2Critical | 4.0 | CVEProject cvelistV5 (CNA) (suse) | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| 9.0Critical | 3.1 | CVEProject cvelistV5 (CNA) (suse) | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| SUSE | Container suse/kiosk/tigervnc-x11vnc:1.14-63.8 | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Container suse/kiosk/xorg:21.1-83.7 | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES-SAP-Azure | ? ≤ v < 2.0.7-160000.5.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES-SAP-Azure-3P | ? ≤ v < 2.0.7-160000.5.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES-SAP-BYOS-Azure | ? ≤ v < 2.0.7-160000.5.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES-SAP-BYOS-EC2 | ? ≤ v < 2.0.7-160000.5.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES-SAP-BYOS-GCE | ? ≤ v < 2.0.7-160000.5.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES-SAP-GCE | ? ≤ v < 2.0.7-160000.5.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES-SAP-GCE-3P | ? ≤ v < 2.0.7-160000.5.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES-SAPCAL-GCE | ? ≤ v < 2.0.7-160000.5.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES12-SP5-Azure-SAP-BYOS | ? ≤ v < 2.0.3-3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES12-SP5-Azure-SAP-On-Demand | ? ≤ v < 2.0.3-3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES12-SP5-EC2-SAP-BYOS | ? ≤ v < 2.0.3-3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES12-SP5-EC2-SAP-On-Demand | ? ≤ v < 2.0.3-3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES12-SP5-GCE-SAP-BYOS | ? ≤ v < 2.0.3-3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES12-SP5-GCE-SAP-On-Demand | ? ≤ v < 2.0.3-3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP6-SAP | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP6-SAP-Azure | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP6-SAP-Azure-3P | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP6-SAP-BYOS | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP6-SAP-BYOS-Azure | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP6-SAP-BYOS-EC2 | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP6-SAP-BYOS-GCE | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP6-SAP-EC2 | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP6-SAP-GCE | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP6-SAP-Hardened | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP6-SAP-Hardened-Azure | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP6-SAP-Hardened-BYOS | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP6-SAP-Hardened-BYOS-Azure | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP6-SAP-Hardened-BYOS-EC2 | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP6-SAP-Hardened-BYOS-GCE | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP6-SAP-Hardened-EC2 | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP6-SAP-Hardened-GCE | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP6-SAPCAL | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP6-SAPCAL-Azure | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP6-SAPCAL-EC2 | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP6-SAPCAL-GCE | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP7-SAP-Azure | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP7-SAP-Azure-3P | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP7-SAP-BYOS-Azure | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP7-SAP-BYOS-EC2 | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP7-SAP-BYOS-GCE | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP7-SAP-EC2 | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP7-SAP-GCE | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP7-SAP-GCE-3P | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP7-SAP-Hardened-Azure | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP7-SAP-Hardened-BYOS-Azure | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP7-SAP-Hardened-BYOS-EC2 | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP7-SAP-Hardened-BYOS-GCE | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP7-SAP-Hardened-GCE | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP7-SAPCAL-Azure | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP7-SAPCAL-EC2 | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP7-SAPCAL-GCE | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Liberty Linux 10 | ? ≤ v < 2.0.6-5.el10_2.3 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Liberty Linux 10 | ? ≤ v < 2.0.6-5.el10_2.3 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Liberty Linux 8 | ? ≤ v < 2.0.3-2.el8_10.3 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Liberty Linux 8 | ? ≤ v < 2.0.3-2.el8_10.3 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Liberty Linux 9 | ? ≤ v < 2.0.3-12.el9_8.3 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Liberty Linux 9 | ? ≤ v < 2.0.3-12.el9_8.3 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Desktop 15 SP7 | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Desktop 15 SP7 | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Module for Basesystem 15 SP7 | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Module for Basesystem 15 SP7 | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server 12 SP5-LTSS | ? ≤ v < 2.0.3-3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server 15 SP4-LTSS | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server 15 SP4-LTSS | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server 15 SP5-LTSS | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server 15 SP5-LTSS | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server 15 SP6-LTSS | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server 15 SP6-LTSS | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server 15 SP7 | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server 15 SP7 | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server 16.0 | ? ≤ v < 2.0.7-160000.5.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server 16.0 | ? ≤ v < 2.0.7-160000.5.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | ? ≤ v < 2.0.3-3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server for SAP Applications 15 SP4 | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server for SAP Applications 15 SP4 | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server for SAP Applications 15 SP5 | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server for SAP Applications 15 SP5 | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server for SAP Applications 15 SP6 | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server for SAP Applications 15 SP6 | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server for SAP Applications 15 SP7 | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server for SAP Applications 15 SP7 | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server for SAP applications 16.0 | ? ≤ v < 2.0.7-160000.5.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server for SAP applications 16.0 | ? ≤ v < 2.0.7-160000.5.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Manager Proxy LTS 4.3 | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Manager Proxy LTS 4.3 | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Manager Retail Branch Server LTS 4.3 | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Manager Retail Branch Server LTS 4.3 | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Manager Server LTS 4.3 | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Manager Server LTS 4.3 | ? ≤ v < 2.0.3-150000.3.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | openSUSE Leap 16.0 | ? ≤ v < 2.0.7-160000.5.1 | CVEProject cvelistV5 (CNA) |
| SUSE | openSUSE Leap 16.0 | ? ≤ v < 2.0.7-160000.5.1 | CVEProject cvelistV5 (CNA) |
| SUSE | openSUSE Tumbleweed | ? ≤ v < 2.0.7-3.1 | CVEProject cvelistV5 (CNA) |
| SUSE | openSUSE Tumbleweed | ? ≤ v < 2.0.7-3.1 | CVEProject cvelistV5 (CNA) |
| SUSE | openSUSE Tumbleweed | ? ≤ v < 2.0.7-3.1 | CVEProject cvelistV5 (CNA) |
| SUSE | openSUSE Tumbleweed | ? ≤ v < 2.0.7-3.1 | CVEProject cvelistV5 (CNA) |
| libXfont2 | libXfont2 | ? ≤ v ≤ 2.0.8 | CVEProject cvelistV5 (CNA) |
References and advisories
1
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-09-10
- Last updated
- 2026-09-10
- State
- Published
- Assigner (CNA)
- suse
Exploit prediction (EPSS)
0.25%
Probability of exploitation in 30 days
17.3%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-787Out-of-bounds Write