CVE-2026-123785

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-123785", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-06T14:37:46.448Z", "datePublished": "2026-11-06T15:01:01.397Z", "dateUpdated": "2026-11-06T16:46:17.952Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-06T15:01:01.397Z"}, "datePublic": "2026-11-01T00:00:00.000Z", "title": "Fluxbox through 1.3.7 Infinite Loop via Menu::updateMenu() Style Geometry", "descriptions": [{"lang": "en", "value": "Fluxbox through 1.3.7 contains an infinite loop vulnerability in Menu::updateMenu() in src/FbTk/Menu.cc that allows attackers to hang the window manager via crafted style geometry values. Attackers can supply a style with an oversized unbounded menu.titleHeight so the column loop never terminates, causing sustained CPU use and denial of service at startup."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Loop with Unreachable Exit Condition ('Infinite Loop')", "cweId": "CWE-835", "type": "CWE"}]}], "affected": [{"vendor": "fluxbox", "product": "fluxbox", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "1.3.7", "status": "affected", "versionType": "custom"}], "packageURL": "pkg:github/fluxbox/fluxbox"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/fluxbox/fluxbox/pull/90", "tags": ["issue-tracking", "patch"], "name": "Pull Request #90"}, {"url": "https://github.com/fluxbox/fluxbox", "tags": ["product"]}, {"url": "https://github.com/fluxbox/fluxbox/blob/Release-1_3_7/src/FbTk/Menu.cc#L433-L448", "name": "Menu::updateMenu column loop", "tags": ["technical-description"]}, {"name": "VulnCheck Advisory: Fluxbox through 1.3.7 Infinite Loop via Menu::updateMenu() Style Geometry", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/fluxbox-through-1.3.7-infinite-loop-via-menu-updatemenu-style-geometry"}], "credits": [{"lang": "en", "value": "Igor Marcel", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-06T16:46:13.010145Z", "id": "CVE-2026-123785", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T16:46:17.952Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-123785", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T16:46:13.010145Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T16:46:00.951Z"}}], "cna": {"title": "Fluxbox through 1.3.7 Infinite Loop via Menu::updateMenu() Style Geometry", "credits": [{"lang": "en", "type": "finder", "value": "Igor Marcel"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 6.8, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "fluxbox", "product": "fluxbox", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.3.7"}], "packageURL": "pkg:github/fluxbox/fluxbox", "defaultStatus": "unaffected"}], "datePublic": "2026-11-01T00:00:00.000Z", "references": [{"url": "https://github.com/fluxbox/fluxbox/pull/90", "name": "Pull Request #90", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/fluxbox/fluxbox", "tags": ["product"]}, {"url": "https://github.com/fluxbox/fluxbox/blob/Release-1_3_7/src/FbTk/Menu.cc#L433-L448", "name": "Menu::updateMenu column loop", "tags": ["technical-description"]}, {"url": "https://www.vulncheck.com/advisories/fluxbox-through-1.3.7-infinite-loop-via-menu-updatemenu-style-geometry", "name": "VulnCheck Advisory: Fluxbox through 1.3.7 Infinite Loop via Menu::updateMenu() Style Geometry", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Fluxbox through 1.3.7 contains an infinite loop vulnerability in Menu::updateMenu() in src/FbTk/Menu.cc that allows attackers to hang the window manager via crafted style geometry values. Attackers can supply a style with an oversized unbounded menu.titleHeight so the column loop never terminates, causing sustained CPU use and denial of service at startup."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-835", "description": "Loop with Unreachable Exit Condition ('Infinite Loop')"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-06T15:01:01.397Z"}}}, "cveMetadata": {"cveId": "CVE-2026-123785", "state": "PUBLISHED", "dateUpdated": "2026-11-06T16:46:17.952Z", "dateReserved": "2026-11-06T14:37:46.448Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-11-06T15:01:01.397Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/fluxbox/fluxbox", "product": "fluxbox", "vendor": "fluxbox", "versions": [{"lessThanOrEqual": "1.3.7", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Fluxbox through 1.3.7 contains an infinite loop vulnerability in Menu::updateMenu() in src/FbTk/Menu.cc that allows attackers to hang the window manager via crafted style geometry values. Attackers can supply a style with an oversized unbounded menu.titleHeight so the column loop never terminates, causing sustained CPU use and denial of service at startup."}], "id": "CVE-2026-123785", "lastModified": "2026-11-12T21:35:47.960", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-123785", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T16:46:13.010145Z", "version": "2.0.3"}}]}, "published": "2026-11-06T15:17:21.467", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/fluxbox/fluxbox"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/fluxbox/fluxbox/blob/Release-1_3_7/src/FbTk/Menu.cc#L433-L448"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/fluxbox/fluxbox/pull/90"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/fluxbox-through-1.3.7-infinite-loop-via-menu-updatemenu-style-geometry"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-835"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "fluxbox: fluxbox: Denial of Service via crafted style geometry values", "id": "2568289", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2568289"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-835", "details": ["Fluxbox through 1.3.7 contains an infinite loop vulnerability in Menu::updateMenu() in src/FbTk/Menu.cc that allows attackers to hang the window manager via crafted style geometry values. Attackers can supply a style with an oversized unbounded menu.titleHeight so the column loop never terminates, causing sustained CPU use and denial of service at startup.", "A flaw was found in Fluxbox. This vulnerability allows an attacker to cause an infinite loop by providing a crafted style configuration containing oversized geometry values, such as an unbounded menu title height. When the style is loaded, the window manager hangs, resulting in sustained CPU utilization and a Denial of Service (DoS)."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-123785", "public_date": "2026-11-06T15:01:01Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-123785\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-123785\nhttps://github.com/fluxbox/fluxbox\nhttps://github.com/fluxbox/fluxbox/blob/Release-1_3_7/src/FbTk/Menu.cc#L433-L448\nhttps://github.com/fluxbox/fluxbox/pull/90\nhttps://www.vulncheck.com/advisories/fluxbox-through-1.3.7-infinite-loop-via-menu-updatemenu-style-geometry"], "statement": "This vulnerability is rated as having Moderate impact because exploitation requires local user interaction to load a malicious theme, and the blast radius is restricted to an application hang without compromising system confidentiality or integrity. An attacker must convince a user to load an excessively large style parameter, triggering an unrecoverable loop during menu rendering. The issue only impacts the availability of the active graphical session and cannot be exploited remotely or leveraged for privilege escalation. No Red Hat Enterprise Linux product ships fluxbox; this flaw affects Fedora and EPEL only.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.3.7]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "fluxbox", "source": "cna", "vendor": "fluxbox"}, "product": "fluxbox", "vendor": "fluxbox-team"}], "created": "2026-11-06T16:45:05.629217+00:00", "updated": "2026-11-10T08:30:23.067705+00:00", "vendors": ["fluxbox-team", "fluxbox-team$PRODUCT$fluxbox"]}