This advisory covers three heap buffer overflow vulnerabilities in the libXfont2 component of the X.Org X11 system on Red Hat Enterprise Linux 8. The flaws include an integer overflow in BitmapScaleBitmaps (CVE-2026-56001), a heap buffer overflow during PCF font parsing (CVE-2026-56002), and a heap buffer overflow in the computeProps property buffer (CVE-2026-56003). These vulnerabilities could potentially lead to memory corruption. Red Hat has issued updated libXfont2 packages to fix these issues. The advisory references Red Hat Enterprise Linux 8 versions from 8.0 up to but not including 8.10.1 as affected. The update is rated as important, indicating a significant security impact but not critical. No active exploitation has been reported.

The vulnerabilities involve heap buffer overflows which may allow an attacker to cause memory corruption, potentially leading to denial of service or other impacts depending on the context of libXfont2 usage. Red Hat rates the security impact as important, indicating a high but not critical severity. No known exploits in the wild have been reported, and no CVSS scores are provided to quantify the risk further.

Red Hat has released updated libXfont2 packages that address these vulnerabilities. Users of Red Hat Enterprise Linux 8 should apply the security update as detailed in Red Hat Advisory RHSA-2026:47103. For instructions on applying the update, refer to https://access.redhat.com/articles/11258. Systems updated to the fixed package versions are no longer vulnerable. No additional mitigation steps are specified or required beyond applying the official update.