CVE-2026-123785mediumCWE-835

CVE-2026-123785: medium-severity vulnerability in fluxbox

Fluxbox through 1.3.7 Infinite Loop via Menu::updateMenu() Style Geometry

Published

Follow this CVE+ Monitor fluxbox+ Monitor fluxbox

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.8epss 0.2%
Fluxbox through 1.3.7 contains an infinite loop vulnerability in Menu::updateMenu() in src/FbTk/Menu.cc that allows attackers to hang the window manager via crafted style geometry values. Attackers can supply a style with an oversized unbounded menu.titleHeight so the column loop never terminates, causing sustained CPU use and denial of service at startup.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
fluxbox · fluxbox
Related CVEs — fluxbox

In the same product, most dangerous first.

CVE-2026-123784HIGHFluxbox through 1.3.7 OS Command Injection via Style Background ValuesEPSS 0.7%