A flaw in the libXfont2 font-server client allows a malicious font server to send specially crafted glyph data, causing a heap buffer overflow. The overflow occurs when fs_read_glyphs() does not validate the total size of incoming data, resulting in memory corruption beyond its intended buffer. If the X server runs with elevated privileges, this corruption can be leveraged to execute arbitrary code or elevate privileges. If the server runs as an unprivileged user, the overflow could cause a denial of service by crashing the X server.

This vulnerability affects systems that use the libXfont2 font server client, part of the libxfonts2 package. No specific version numbers are provided in the advisory; however, any installation of libXfont2 before the fix is potentially impacted.

The CVSS score of 7.5 indicates a high severity risk. While an EPSS score is not available, the lack of a CISA KEV listing does not negate the potential for exploitation. The attack would require an attacker to control or supply a malicious font server that communicates with the targeted X server, which could be local or remote depending on network configuration. The resulting privilege escalation or denial of service would affect the entire system depending on the privileges of the X server process.