Heap Buffer Overflow in X Server and XWayland Affecting Local Attackers
CVE-2026-55999

8.5HIGH

Key Information:

Vendor

X.org

Status
Xorg-server
Xwayland
Vendor
CVE Published:
8 July 2026

What is CVE-2026-55999?

A vulnerability exists in xorg-server and xwayland where local attackers can exploit a heap buffer overflow through the SetFont function. This occurs when the server processes PCX fonts without proper glyph boundary checks, allowing the potential for a local user to cause unintended behavior or crash the server. It is essential for users running versions before 21.2.24 of xorg-server or 24.1.13 of xwayland to upgrade to patched versions to mitigate this risk.

Affected Version(s)

xorg-server 0 < 21.1.24

xwayland 0 < 24.1.13

References

https://gitlab.freedesktop.org/xorg/xserver/-/commit/fbf7...
patch
https://www.openwall.com/lists/oss-security/2026/07/08/2
vendor-advisory

CVSS V3.1

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Anonymous working with Trend Micro Zero Day Initiative.
.