TI-2026-42556 CVE-2026-59679 · GHSA-g44m-wpf7-gr7x
fs_read_glyphs() heap OOB read/write via encoding array index mismatch in libXfont2
Priority MEDIUM 41
fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a size derived from n…