CVE-2026-123785
Description
A flaw was found in Fluxbox. This vulnerability allows an attacker to cause an infinite loop by providing a crafted style configuration containing oversized geometry values, such as an unbounded menu title height. When the style is loaded, the window manager hangs, resulting in sustained CPU utilization and a Denial of Service (DoS).
Statement
This vulnerability is rated as having Moderate impact because exploitation requires local user interaction to load a malicious theme, and the blast radius is restricted to an application hang without compromising system confidentiality or integrity. An attacker must convince a user to load an excessively large style parameter, triggering an unrecoverable loop during menu rendering. The issue only impacts the availability of the active graphical session and cannot be exploited remotely or leveraged for privilege escalation. No Red Hat Enterprise Linux product ships fluxbox; this flaw affects Fedora and EPEL only.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Amplification
An infinite loop will cause unexpected consumption of resources, such as CPU cycles or memory. The software's operation may slow down, or cause a long time to respond.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
