MEDIUM 6.8 NVD
CVE-2026-123785
Fluxbox through 1.3.7 contains an infinite loop vulnerability in Menu::updateMenu() in src/FbTk/Menu.cc that allows attackers to hang the window manager via cra
Fluxbox through 1.3.7 contains an infinite loop vulnerability in Menu::updateMenu() in src/FbTk/Menu.cc that allows attackers to hang the window manager via crafted style geometry values. Attackers can supply a style with an oversized unbounded menu.titleHeight so the column loop never terminates, causing sustained CPU use and denial of service at startup.
References
- https://github.com/fluxbox/fluxbox
- https://github.com/fluxbox/fluxbox/blob/Release-1_3_7/src/FbTk/Menu.cc#L433-L448
- https://github.com/fluxbox/fluxbox/pull/90
- https://www.vulncheck.com/advisories/fluxbox-through-1.3.7-infinite-loop-via-menu-updateme
This medium severity vulnerability with a CVSS score of 6.8 was published on 2026-11-06 via NVD.
vulnfeed aggregates 16326 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.