The fs_read_glyphs() function in libXfont2 copies cumulative glyph bitmap data into a single destination buffer without verifying that the total write size fits the allocated space. A malicious font server can send many glyphs with overlapping source offsets, causing the cumulative writes to exceed the small allocated buffer. This triggers a heap buffer overflow that allows an attacker to inject arbitrary code. If the X server runs with elevated privileges, an exploit may result in privilege escalation or arbitrary code execution. Even when running as unprivileged, the overflow can cause denial of service by crashing the X server.

This flaw impacts systems that client, specifically SUSE Linux Enterprise Server and Desktop releases such as SLES 12 SP5, 15 SP6, 15 SP7, and 16.0, as well as various SAP‑aligned images (SLES for SAP Applications, SAP). It also affects SUSE's container images suse/kiosk/tigervnc-x11vnc, suse/kiosk/xorg, and the libXfont2 package on openSUSE Leap and Tumbleweed. Any installation of libXfont2 before the fix is considered affected.

The vulnerability has a CVSS score of 9.5, indicating critical severity. The EPSS score is less than 1%, indicating a very low but non‑zero exploitation probability, but the absence of a publicly known and unpatched systems remain exposed. The attack requires an attacker to control or supply a malicious font server that communicates with the target X server; this can be local or remote depending on how the X server allows font server connections. Successful exploitation may result in remote code execution and privilege escalation for the X server process, or a denial of service if the target is unprivileged.