Search
Find a vulnerability
Search criteria
4 vulnerabilities by fluxbox
CVE-2026-123785 (GCVE-0-2026-123785)
Vulnerability from nvd – Published: 2026-11-06 15:01 – Updated: 2026-11-06 16:46
VLAI
EPSS
VEX
Title
Fluxbox through 1.3.7 Infinite Loop via Menu::updateMenu() Style Geometry
Summary
Fluxbox through 1.3.7 contains an infinite loop vulnerability in Menu::updateMenu() in src/FbTk/Menu.cc that allows attackers to hang the window manager via crafted style geometry values. Attackers can supply a style with an oversized unbounded menu.titleHeight so the column loop never terminates, causing sustained CPU use and denial of service at startup.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 16:46 UTC
CWE
- CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/fluxbox/fluxbox/pull/90 | issue-trackingpatch |
| https://github.com/fluxbox/fluxbox | product |
| https://github.com/fluxbox/fluxbox/blob/Release-1… | technical-description |
| https://www.vulncheck.com/advisories/fluxbox-thro… | third-party-advisory |
Date Public
2026-11-01 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-123785",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T16:46:13.010145Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:46:17.952Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/fluxbox/fluxbox",
"product": "fluxbox",
"vendor": "fluxbox",
"versions": [
{
"lessThanOrEqual": "1.3.7",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Igor Marcel"
}
],
"datePublic": "2026-11-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Fluxbox through 1.3.7 contains an infinite loop vulnerability in Menu::updateMenu() in src/FbTk/Menu.cc that allows attackers to hang the window manager via crafted style geometry values. Attackers can supply a style with an oversized unbounded menu.titleHeight so the column loop never terminates, causing sustained CPU use and denial of service at startup."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-835",
"description": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T15:01:01.397Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Pull Request #90",
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/fluxbox/fluxbox/pull/90"
},
{
"tags": [
"product"
],
"url": "https://github.com/fluxbox/fluxbox"
},
{
"name": "Menu::updateMenu column loop",
"tags": [
"technical-description"
],
"url": "https://github.com/fluxbox/fluxbox/blob/Release-1_3_7/src/FbTk/Menu.cc#L433-L448"
},
{
"name": "VulnCheck Advisory: Fluxbox through 1.3.7 Infinite Loop via Menu::updateMenu() Style Geometry",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/fluxbox-through-1.3.7-infinite-loop-via-menu-updatemenu-style-geometry"
}
],
"title": "Fluxbox through 1.3.7 Infinite Loop via Menu::updateMenu() Style Geometry",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-123785",
"datePublished": "2026-11-06T15:01:01.397Z",
"dateReserved": "2026-11-06T14:37:46.448Z",
"dateUpdated": "2026-11-06T16:46:17.952Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123784 (GCVE-0-2026-123784)
Vulnerability from nvd – Published: 2026-11-06 15:01 – Updated: 2026-11-06 15:01
VLAI
EPSS
VEX
Title
Fluxbox through 1.3.7 OS Command Injection via Style Background Values
Summary
Fluxbox through 1.3.7 contains an OS command injection vulnerability in RootTheme::reconfigTheme() that allows attackers to execute commands via crafted style background values. Attackers can embed shell metacharacters in background pixmap paths, random directories, or gradient texture text, which are concatenated unescaped into an fbsetbg command run via $SHELL -c when the style loads.
Severity
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/fluxbox/fluxbox/pull/89 | issue-trackingpatch |
| https://github.com/fluxbox/fluxbox | product |
| https://github.com/fluxbox/fluxbox/commit/270bfbc… | patch |
| https://github.com/fluxbox/fluxbox/blob/Release-1… | technical-description |
| https://www.vulncheck.com/advisories/fluxbox-thro… | third-party-advisory |
Date Public
2026-11-01 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/fluxbox/fluxbox",
"product": "fluxbox",
"vendor": "fluxbox",
"versions": [
{
"lessThanOrEqual": "1.3.7",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Igor Marcel"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Mathias Gumz"
}
],
"datePublic": "2026-11-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Fluxbox through 1.3.7 contains an OS command injection vulnerability in RootTheme::reconfigTheme() that allows attackers to execute commands via crafted style background values. Attackers can embed shell metacharacters in background pixmap paths, random directories, or gradient texture text, which are concatenated unescaped into an fbsetbg command run via $SHELL -c when the style loads."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T15:01:00.678Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Pull Request #89",
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/fluxbox/fluxbox/pull/89"
},
{
"tags": [
"product"
],
"url": "https://github.com/fluxbox/fluxbox"
},
{
"name": "Fix commit 270bfbc",
"tags": [
"patch"
],
"url": "https://github.com/fluxbox/fluxbox/commit/270bfbc28573037c9b8458488d193b219e33889f"
},
{
"name": "RootTheme::reconfigTheme",
"tags": [
"technical-description"
],
"url": "https://github.com/fluxbox/fluxbox/blob/Release-1_3_7/src/RootTheme.cc#L192-L264"
},
{
"name": "VulnCheck Advisory: Fluxbox through 1.3.7 OS Command Injection via Style Background Values",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/fluxbox-through-1.3.7-os-command-injection-via-style-background-values"
}
],
"title": "Fluxbox through 1.3.7 OS Command Injection via Style Background Values",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-123784",
"datePublished": "2026-11-06T15:01:00.678Z",
"dateReserved": "2026-11-06T14:37:46.094Z",
"dateUpdated": "2026-11-06T15:01:00.678Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123785 (GCVE-0-2026-123785)
Vulnerability from cvelistv5 – Published: 2026-11-06 15:01 – Updated: 2026-11-06 16:46
VLAI
EPSS
VEX
Title
Fluxbox through 1.3.7 Infinite Loop via Menu::updateMenu() Style Geometry
Summary
Fluxbox through 1.3.7 contains an infinite loop vulnerability in Menu::updateMenu() in src/FbTk/Menu.cc that allows attackers to hang the window manager via crafted style geometry values. Attackers can supply a style with an oversized unbounded menu.titleHeight so the column loop never terminates, causing sustained CPU use and denial of service at startup.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 16:46 UTC
CWE
- CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/fluxbox/fluxbox/pull/90 | issue-trackingpatch |
| https://github.com/fluxbox/fluxbox | product |
| https://github.com/fluxbox/fluxbox/blob/Release-1… | technical-description |
| https://www.vulncheck.com/advisories/fluxbox-thro… | third-party-advisory |
Date Public
2026-11-01 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-123785",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T16:46:13.010145Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:46:17.952Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/fluxbox/fluxbox",
"product": "fluxbox",
"vendor": "fluxbox",
"versions": [
{
"lessThanOrEqual": "1.3.7",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Igor Marcel"
}
],
"datePublic": "2026-11-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Fluxbox through 1.3.7 contains an infinite loop vulnerability in Menu::updateMenu() in src/FbTk/Menu.cc that allows attackers to hang the window manager via crafted style geometry values. Attackers can supply a style with an oversized unbounded menu.titleHeight so the column loop never terminates, causing sustained CPU use and denial of service at startup."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-835",
"description": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T15:01:01.397Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Pull Request #90",
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/fluxbox/fluxbox/pull/90"
},
{
"tags": [
"product"
],
"url": "https://github.com/fluxbox/fluxbox"
},
{
"name": "Menu::updateMenu column loop",
"tags": [
"technical-description"
],
"url": "https://github.com/fluxbox/fluxbox/blob/Release-1_3_7/src/FbTk/Menu.cc#L433-L448"
},
{
"name": "VulnCheck Advisory: Fluxbox through 1.3.7 Infinite Loop via Menu::updateMenu() Style Geometry",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/fluxbox-through-1.3.7-infinite-loop-via-menu-updatemenu-style-geometry"
}
],
"title": "Fluxbox through 1.3.7 Infinite Loop via Menu::updateMenu() Style Geometry",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-123785",
"datePublished": "2026-11-06T15:01:01.397Z",
"dateReserved": "2026-11-06T14:37:46.448Z",
"dateUpdated": "2026-11-06T16:46:17.952Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123784 (GCVE-0-2026-123784)
Vulnerability from cvelistv5 – Published: 2026-11-06 15:01 – Updated: 2026-11-06 15:01
VLAI
EPSS
VEX
Title
Fluxbox through 1.3.7 OS Command Injection via Style Background Values
Summary
Fluxbox through 1.3.7 contains an OS command injection vulnerability in RootTheme::reconfigTheme() that allows attackers to execute commands via crafted style background values. Attackers can embed shell metacharacters in background pixmap paths, random directories, or gradient texture text, which are concatenated unescaped into an fbsetbg command run via $SHELL -c when the style loads.
Severity
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/fluxbox/fluxbox/pull/89 | issue-trackingpatch |
| https://github.com/fluxbox/fluxbox | product |
| https://github.com/fluxbox/fluxbox/commit/270bfbc… | patch |
| https://github.com/fluxbox/fluxbox/blob/Release-1… | technical-description |
| https://www.vulncheck.com/advisories/fluxbox-thro… | third-party-advisory |
Date Public
2026-11-01 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/fluxbox/fluxbox",
"product": "fluxbox",
"vendor": "fluxbox",
"versions": [
{
"lessThanOrEqual": "1.3.7",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Igor Marcel"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Mathias Gumz"
}
],
"datePublic": "2026-11-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Fluxbox through 1.3.7 contains an OS command injection vulnerability in RootTheme::reconfigTheme() that allows attackers to execute commands via crafted style background values. Attackers can embed shell metacharacters in background pixmap paths, random directories, or gradient texture text, which are concatenated unescaped into an fbsetbg command run via $SHELL -c when the style loads."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T15:01:00.678Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Pull Request #89",
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/fluxbox/fluxbox/pull/89"
},
{
"tags": [
"product"
],
"url": "https://github.com/fluxbox/fluxbox"
},
{
"name": "Fix commit 270bfbc",
"tags": [
"patch"
],
"url": "https://github.com/fluxbox/fluxbox/commit/270bfbc28573037c9b8458488d193b219e33889f"
},
{
"name": "RootTheme::reconfigTheme",
"tags": [
"technical-description"
],
"url": "https://github.com/fluxbox/fluxbox/blob/Release-1_3_7/src/RootTheme.cc#L192-L264"
},
{
"name": "VulnCheck Advisory: Fluxbox through 1.3.7 OS Command Injection via Style Background Values",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/fluxbox-through-1.3.7-os-command-injection-via-style-background-values"
}
],
"title": "Fluxbox through 1.3.7 OS Command Injection via Style Background Values",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-123784",
"datePublished": "2026-11-06T15:01:00.678Z",
"dateReserved": "2026-11-06T14:37:46.094Z",
"dateUpdated": "2026-11-06T15:01:00.678Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}