Read the docs
TI-2026-85965 Aliases CVE-2026-123785GHSA-8g4r-mwj3-fw99

Infinite loop in Fluxbox menu update via style geometry

Priority LOW 29CWE-835Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-835.

Summary

Fluxbox through 1.3.7 contains an infinite loop in Menu::updateMenu() that lets a local attacker hang the window manager through a crafted style. The column loop has an unreachable exit condition (CWE-835) and never terminates when menu.titleHeight is oversized and unbounded. The attacker needs local access and user interaction, and the window manager then uses sustained CPU and stops responding at startup.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Fluxbox through 1.3.7 contains an infinite loop vulnerability in Menu::updateMenu() in src/FbTk/Menu.cc that allows attackers to hang the window manager via crafted style geometry values. Attackers can supply a style with an oversized unbounded menu.titleHeight so the column loop never terminates, causing sustained CPU use and denial of service at startup.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00165 5th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
fluxboxfluxboxup to 1.3.7—No fix listedCNA
  • fluxbox Vendorfluxbox Affected up to 1.3.7 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for fluxbox.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-123785
  2. 2026-11-06 Alias added: GHSA-8g4r-mwj3-fw99
  3. 2026-11-06 CISA SSVC decision points changed
  4. 2026-11-06 Priority changed: MEDIUM → LOW

References

Patch 1

Other 2

  • TI-2026-85964 OS command injection in Fluxbox style background values CVSS 4.0HIGH 8.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences