The vulnerability in libXfont2 (prior to 2.0.8) involves a heap buffer overflow caused by inadequate size validation in the property buffer during PCF file parsing in the ComputeScaledProperties() function. Exploitation requires an attacker to have authenticated access as an X client, enabling potential code execution within the X server context. The issue affects multiple Ubuntu versions with specific libxfont package versions listed. No known exploits in the wild have been reported.

Successful exploitation could lead to remote code execution within the X server process by an authenticated X client, compromising confidentiality, integrity, and availability of the affected system. The CVSS vector indicates network attack vector, high complexity, low privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the X server to trusted clients only and monitor for unusual activity. Avoid running untrusted X clients on affected systems.