diff --git a/libXfont-1.5.4-CVE-2026-59679.patch b/libXfont-1.5.4-CVE-2026-59679.patch
new file mode 100644
index 0000000000000000000000000000000000000000..0fc187999d537fe5534a244906513d9a725b5270
--- /dev/null
+++ b/libXfont-1.5.4-CVE-2026-59679.patch
@@ -0,0 +1,91 @@
+From 668fea81f40bcb48ec67fb55d0b851049d265290 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Mon, 13 Jul 2026 15:48:06 +1000
+Subject: [PATCH] fserve: validate num_chars against encoding array size in
+ fs_read_glyphs
+
+FS_QueryXExtents16 causes us to allocate the encoding[] array, later
+during the FS_QueryXBitmaps16 reply handling we fill in that array.
+There is no verification that the allocation is large enough, a
+malicious font server could send us a small numExtents and a
+large num_chars to force underallocation and OOB read/rwrite.
+
+A regression test is included that constructs a crafted
+FS_QueryXBitmaps16 reply with num_chars > num_encoding and verifies
+the library rejects it.
+
+CVE-2026-59679
+
+Found-by: Zhixi "Jace" Sun, independent security researcher
+Assisted-by: Claude:claude-opus-4-6
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+Part-of: <https://gitlab.freedesktop.org/xorg/lib/libxfont/-/merge_requests/36>
+Adapted-by: PkgAgent/deepseek-v4 (modified to adapt to opencloudos-stream)
+Note: 1.x has no test infrastructure; the Makefile.am and test-fserve-read-glyphs.c
+      hunks (2.x-only) were dropped, the security fix hunks are applied verbatim.
+
+---
+ src/fc/fserve.c    | 22 ++++++++++++++++++++++
+ src/fc/fservestr.h |  1 +
+ 2 files changed, 23 insertions(+)
+diff --git a/src/fc/fserve.c b/src/fc/fserve.c
+index 4fb5551..d2f2658 100644
+--- a/src/fc/fserve.c
++++ b/src/fc/fserve.c
+@@ -1079,6 +1079,7 @@ fs_read_extent_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
+ 	return AllocError;
+     }
+     fsfont->encoding = pCI;
++    fsfont->num_encoding = numExtents;
+     if (haveInk)
+ 	fsfont->inkMetrics = pCI + numExtents;
+     else
+@@ -1993,6 +1994,17 @@ fs_read_glyphs(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
+     {
+ 	minchar = 0;
+ 	maxchar = rep->num_chars;
++
++	/* Reject replies where num_chars exceeds the encoding array
++	   size allocated in fs_read_extent_info() to prevent
++	   out-of-bounds access on encoding[]. */
++	if (rep->num_chars > (CARD32)fsdata->num_encoding)
++	{
++	    ErrorF("fserve: num_chars (%u) > num_encoding (%d)\n",
++		   (unsigned) rep->num_chars, fsdata->num_encoding);
++	    err = AllocError;
++	    goto bail;
++	}
+     }
+ 
+     off_adr = (char *)ppbits;
+@@ -2014,6 +2026,16 @@ fs_read_glyphs(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
+     for (i = 0; i < rep->num_chars; i++)
+     {
+ 	memcpy(&local_off, off_adr, SIZEOF(fsOffset32));	/* align it */
++	/* Bounds-check minchar against the encoding array size to
++	   prevent out-of-bounds access from a malicious font server
++	   reply with more num_chars than num_extents. */
++	if (minchar >= (unsigned long)fsdata->num_encoding)
++	{
++	    ErrorF("fserve: glyph index %lu >= num_encoding (%d)\n",
++		   minchar, fsdata->num_encoding);
++	    err = AllocError;
++	    goto bail;
++	}
+ 	if (blockrec->type == FS_OPEN_FONT ||
+ 	    fsdata->encoding[minchar].bits == &_fs_glyph_requested)
+ 	{
+diff --git a/src/fc/fservestr.h b/src/fc/fservestr.h
+index 29ae46e..da95e41 100644
+--- a/src/fc/fservestr.h
++++ b/src/fc/fservestr.h
+@@ -43,6 +43,7 @@ typedef struct _fs_glyph {
+ typedef struct _fs_font {
+     CharInfoPtr pDefault;
+     CharInfoPtr encoding;
++    int		num_encoding;
+     CharInfoPtr inkMetrics;
+     FSGlyphPtr	glyphs;
+ }           FSFontRec, *FSFontPtr;
+-- 
+GitLab
diff --git a/libXfont.spec b/libXfont.spec
index 6709e6c987d96a7b72a39847a0756bf3d4ff20e2..b1dfd6486a2cc8dada4b4b129bb0786acd69d7a8 100644
--- a/libXfont.spec
+++ b/libXfont.spec
@@ -1,11 +1,12 @@
 Summary: X.Org X11 libXfont runtime library
 Name: libXfont
 Version: 1.5.4
-Release:    2%{?dist}
+Release:    3%{?dist}
 License: MIT
 URL: http://www.x.org
 
 Source0: http://www.x.org/pub/individual/lib/%{name}-%{version}.tar.bz2
+Patch0001: libXfont-1.5.4-CVE-2026-59679.patch
 
 BuildRequires: make
 BuildRequires: autoconf automake libtool
@@ -28,6 +29,7 @@ X.Org X11 libXfont development package
 
 %prep
 %setup -q
+%patch -P 1 -p1
 
 %build
 autoreconf -v --install --force
@@ -68,6 +70,10 @@ rm -f %{buildroot}%{_libdir}/*.la
 %{_libdir}/pkgconfig/xfont.pc
 
 %changelog
+* Tue Sep 22 2026 PkgAgent Robot <pkgagent@opencloudos.tech> - 1.5.4-3
+- [Type] security
+- [DESC] Fix CVE-2026-59679: fs_read_glyphs() OOB read/write via unchecked num_chars vs encoding[] size
+
 * Wed Jun 11 2025 bbrucezhang <bbrucezhang@tencent.com> - 1.5.4-2
 - Rebuilt for loongarch64