CVE-2026-56002 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	8.5 HIGH	NETWORK	HIGH	LOW	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 35.97%

Affected Products (NVD)

Vendor	Product	Version
x	libxfont	𝑥 < 2.0.8

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

libxfont

bookworm	vulnerable
bookworm (security)	1:2.0.6-1+deb12u1 fixed
bullseye	vulnerable
bullseye (security)	1:2.0.4-1+deb11u1 fixed
forky	1:2.0.9-1 fixed
sid	1:2.0.9-1 fixed
trixie	vulnerable
trixie (security)	1:2.0.6-1+deb13u1 fixed

Ubuntu Releases

Ubuntu Product

Codename

libxfont

bionic	Fixed 1:2.0.3-1ubuntu0.1~esm2 released
focal	Fixed 1:2.0.3-1ubuntu0.20.04.1~esm2 released
jammy	Fixed 1:2.0.5-1ubuntu0.2 released
noble	Fixed 1:2.0.6-1+deb13u1build0.24.04.2 released
questing	ignored
resolute	Fixed 1:2.0.6-2ubuntu0.2 released
trusty	Fixed 1:1.4.7-1ubuntu0.4+esm2 released
xenial	Fixed 1:1.5.1-1ubuntu0.16.04.4+esm2 released

libxfont2

jammy	dne
noble	dne
questing	dne
resolute	dne
xenial	needs-triage

openSUSE / SLES Releases

openSUSE Product

Release

libXfont2-2

suse enterprise desktop 15 SP7	2.0.3-150000.3.3.1 fixed
suse enterprise sap 15 SP4	2.0.3-150000.3.3.1 fixed
suse enterprise sap 15 SP5	2.0.3-150000.3.3.1 fixed
suse enterprise sap 15 SP6	2.0.3-150000.3.3.1 fixed
suse enterprise sap 15 SP7	2.0.3-150000.3.3.1 fixed
suse enterprise server 15 SP4	2.0.3-150000.3.3.1 fixed
suse enterprise server 15 SP5	2.0.3-150000.3.3.1 fixed
suse enterprise server 15 SP6	2.0.3-150000.3.3.1 fixed
suse enterprise server 15 SP7	2.0.3-150000.3.3.1 fixed

libXfont2-devel

suse enterprise desktop 15 SP7	2.0.3-150000.3.3.1 fixed
suse enterprise sap 15 SP4	2.0.3-150000.3.3.1 fixed
suse enterprise sap 15 SP5	2.0.3-150000.3.3.1 fixed
suse enterprise sap 15 SP6	2.0.3-150000.3.3.1 fixed
suse enterprise sap 15 SP7	2.0.3-150000.3.3.1 fixed
suse enterprise server 15 SP4	2.0.3-150000.3.3.1 fixed
suse enterprise server 15 SP5	2.0.3-150000.3.3.1 fixed
suse enterprise server 15 SP6	2.0.3-150000.3.3.1 fixed
suse enterprise server 15 SP7	2.0.3-150000.3.3.1 fixed

Red Hat Enterprise Linux Releases

Red Hat Product

Release

libXfont2

RHEL 8	0:2.0.3-2.el8_10.1 fixed
RHEL 9	0:2.0.3-12.el9_8.1 fixed

libXfont2-devel

RHEL 8	0:2.0.3-2.el8_10.1 fixed
RHEL 9	0:2.0.3-12.el9_8.1 fixed

Amazon Linux Releases

Amazon Package

Release

libXfont

Amazon Linux 2

0:1.5.4-1.amzn2.0.1

fixed

libXfont-debuginfo

Amazon Linux 2

0:1.5.4-1.amzn2.0.1

fixed

libXfont-devel

Amazon Linux 2

0:1.5.4-1.amzn2.0.1

fixed

libXfont2

Amazon Linux 2	0:2.0.3-1.amzn2.0.1 fixed
Amazon Linux 2023	0:2.0.7-1.amzn2023.0.2 fixed

libXfont2-debuginfo

Amazon Linux 2	0:2.0.3-1.amzn2.0.1 fixed
Amazon Linux 2023	0:2.0.7-1.amzn2023.0.2 fixed

libXfont2-debugsource

Amazon Linux 2023

0:2.0.7-1.amzn2023.0.2

fixed

libXfont2-devel

Amazon Linux 2	0:2.0.3-1.amzn2.0.1 fixed
Amazon Linux 2023	0:2.0.7-1.amzn2023.0.2 fixed

Azure Linux Releases

Azure Package

Release

libXfont2

Azure Linux 3.0

0:2.0.8-1.azl3

fixed

Common Weakness Enumeration

CWE-122 - Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

References

https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit/b4389e0b1d84a690b819bb27b1439968811a3674

https://www.openwall.com/lists/oss-security/2026/07/08/1