The vulnerability exists in the fs_read_glyphs() function of the libXfont2 font-server client (src/fc/fserve.c). It indexes the per-character encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but the array was allocated based on num_extents from the FS_QueryXExtents16 reply. Since these two CARD32 fields are never cross-checked, a malicious font server can send a small num_extents (e.g., 1) and a large num_chars (e.g., 100000), causing out-of-bounds heap read and write operations controlled by the attacker.

This vulnerability allows an attacker controlling or compromising the font server to cause out-of-bounds heap reads and writes in the client, potentially leading to arbitrary code execution, denial of service, or data corruption. The CVSS score of 9.0 indicates a critical severity with high impact on confidentiality, integrity, and availability without requiring privileges or user interaction.

No official patch or remediation is currently confirmed for this vulnerability. Users should monitor the vendor advisory for updates and apply any official fixes once available. Until then, avoid connecting to untrusted font servers or restrict font server access to trusted sources only.