Fluxbox version 1.3.7 and earlier contain an infinite loop in the Menu::updateMenu function. An attacker can provide a style geometry with an excessively large, unbounded menu.titleHeight value, causing the column loop to never terminate and spamming CPU usage. The resulting hang of the window manager at startup manifests as a denial‑of‑service that disables the graphical session and renders the system unusable until a restart or configuration change occurs.

This issue affects packages named Fluxbox sold by the Fluxbox project, specifically any releases through version 1.3.7 inclusive. Users running these or older releases on any platform that ships the window manager are potentially impacted.

The CVSS score of 6.8 signals a moderate severity, but the exploitability is high once the vulnerable code path is triggered. EPSS data is not available, and the vulnerability has not been listed in the CISA KEV catalog. The attack vector is inferred to be local: it requires the attacker to supply a crafted style configuration, which is usually a local user configuration file. Once executed, the attacker can cause sustained CPU consumption, leading to a permanent hang until the window manager is restarted or the configuration is corrected.