fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice (position, length) lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the allocation. A malicious font server can send overlapping source offsets -- for example 1000 glyphs each referencing {position:0, length:64} with nbytes=64. Each individual source range passes the existing validation, but the cumulative writes total 64000 bytes into a 64-byte destination buffer. This is a heap buffer overflow with attacker-controlled content.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-44950 is a critical buffer overflow vulnerability in libXfont2's glyph rendering function that allows malicious font servers to trigger heap corruption. The vulnerability exists because input validation checks only verify that individual glyph bitmap source ranges are within bounds, but fail to validate that the cumulative destination buffer writes don't exceed the allocated heap space. An attacker controlling a font server can craft requests where multiple glyphs reference overlapping source data with small offsets, causing each write to appear valid individually while collectively overwriting heap memory beyond the destination buffer's boundaries. This affects any application using libXfont2 to render fonts from untrusted or compromised font servers, including X11 implementations, desktop environments, and specialized rendering systems.
While this CVE currently maps to zero Casky skills due to the absence of defined MITRE ATT&CK techniques, Casky's extended reasoning capabilities would detect the attack patterns by analyzing memory access logs and heap allocation patterns. Practitioners would observe: (1) sequential glyph processing calls with identical or near-identical source offsets triggering repeated heap writes, (2) destination buffer cursor position exceeding initial allocation size without reallocation events, and (3) heap corruption indicators (heap metadata corruption, out-of-bounds writes) following font server communication. By mapping memory safety violations to control flow anomalies, Casky could flag suspicious font server interactions where validation passes at individual glyph level but aggregate memory writes violate heap boundaries—enabling detection of this class of validation-bypass vulnerabilities before exploitation occurs.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-44950. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation