The vulnerability is a heap buffer overflow in the pcfReadFont() function of libXfont2 prior to version 2.0.8 caused by missing glyph bounds checking. This flaw allows an attacker with authenticated access as an X client to execute arbitrary code within the X server process. The issue affects various versions of the libxfont package distributed with multiple Ubuntu LTS and non-LTS releases. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, scope changed, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to remote code execution within the X server context, potentially compromising the confidentiality, integrity, and availability of the affected system. The attacker must be authenticated as an X client, which limits the attack surface to users with such access. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor official Ubuntu security advisories for updates regarding libxfont2 version 2.0.8 or later, which presumably contains the fix. Until a patch is applied, restrict access to the X server to trusted users only.