Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-123785 (GCVE-0-2026-123785)

Vulnerability from cvelistv5 – Published: 2026-11-06 15:01 – Updated: 2026-11-06 16:46

Title

Fluxbox through 1.3.7 Infinite Loop via Menu::updateMenu() Style Geometry

Summary

Fluxbox through 1.3.7 contains an infinite loop vulnerability in Menu::updateMenu() in src/FbTk/Menu.cc that allows attackers to hang the window manager via crafted style geometry values. Attackers can supply a style with an oversized unbounded menu.titleHeight so the column loop never terminates, causing sustained CPU use and denial of service at startup.

Severity

6.8 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-06 16:46 UTC

CWE

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Assigner

VulnCheck CNA

References

4 references

URL	Tags
https://github.com/fluxbox/fluxbox/pull/90	issue-trackingpatch
https://github.com/fluxbox/fluxbox	product
https://github.com/fluxbox/fluxbox/blob/Release-1…	technical-description
https://www.vulncheck.com/advisories/fluxbox-thro…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
fluxbox	fluxbox	Affected: 0 , ≤ 1.3.7 (custom)

Date Public

2026-11-01 00:00

Credits

Igor Marcel

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-123785",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-06T16:46:13.010145Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T16:46:17.952Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/fluxbox/fluxbox",
          "product": "fluxbox",
          "vendor": "fluxbox",
          "versions": [
            {
              "lessThanOrEqual": "1.3.7",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Igor Marcel"
        }
      ],
      "datePublic": "2026-11-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Fluxbox through 1.3.7 contains an infinite loop vulnerability in Menu::updateMenu() in src/FbTk/Menu.cc that allows attackers to hang the window manager via crafted style geometry values. Attackers can supply a style with an oversized unbounded menu.titleHeight so the column loop never terminates, causing sustained CPU use and denial of service at startup."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-835",
              "description": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T15:01:01.397Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Pull Request #90",
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/fluxbox/fluxbox/pull/90"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/fluxbox/fluxbox"
        },
        {
          "name": "Menu::updateMenu column loop",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/fluxbox/fluxbox/blob/Release-1_3_7/src/FbTk/Menu.cc#L433-L448"
        },
        {
          "name": "VulnCheck Advisory: Fluxbox through 1.3.7 Infinite Loop via Menu::updateMenu() Style Geometry",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/fluxbox-through-1.3.7-infinite-loop-via-menu-updatemenu-style-geometry"
        }
      ],
      "title": "Fluxbox through 1.3.7 Infinite Loop via Menu::updateMenu() Style Geometry",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-123785",
    "datePublished": "2026-11-06T15:01:01.397Z",
    "dateReserved": "2026-11-06T14:37:46.448Z",
    "dateUpdated": "2026-11-06T16:46:17.952Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-123784 (GCVE-0-2026-123784)

Vulnerability from cvelistv5 – Published: 2026-11-06 15:01 – Updated: 2026-11-06 15:01

Title

Fluxbox through 1.3.7 OS Command Injection via Style Background Values

Summary

Fluxbox through 1.3.7 contains an OS command injection vulnerability in RootTheme::reconfigTheme() that allows attackers to execute commands via crafted style background values. Attackers can embed shell metacharacters in background pixmap paths, random directories, or gradient texture text, which are concatenated unescaped into an fbsetbg command run via $SHELL -c when the style loads.