Heap Buffer Overflow in X Server and XWayland Affecting Local Attackers
CVE-2026-55999

8.5HIGH

Key Information:

Vendor

X.org

Status
Xorg-server
Xwayland
Vendor
CVE Published:
8 July 2026

What is CVE-2026-55999?

CVE-2026-55999 is a vulnerability affecting the X Server and XWayland components managed by X.org, which provide essential graphical display services for UNIX-like operating systems. This particular flaw is classified as a heap buffer overflow, which can occur when localized attack vectors are exploited by malicious users who have an X connection. Specifically, attackers can deliver PCX font data to the server. The vulnerability arises from inadequate checks on glyph boundaries in the SetFont function, which can allow attackers to manipulate memory and potentially execute arbitrary code. Such a breach could severely compromise the integrity and availability of systems relying on X.org for their graphical interface, posing serious risks to organizational security and operational continuity.

Potential Impact of CVE-2026-55999

  1. Unauthorized Access and Control: Attackers can exploit this vulnerability to execute arbitrary code, potentially gaining unauthorized control over affected systems. This could lead to significant data breaches, unauthorized information access, or file manipulation.

  2. Denial of Service: By manipulating the buffer overflow, attackers may induce instability in the X server or XWayland, leading to crashes or unresponsive systems. This can significantly disrupt business operations and degrade the user experience.

  3. Propagation of Malware: The ability to execute arbitrary code can be leveraged to install malicious software, enabling attackers to establish persistent access or deploy further attacks. This could lead to the infection of additional systems within the network, increasing the overall risk to organizational cybersecurity.

Affected Version(s)

xorg-server 0 < 21.1.24

xwayland 0 < 24.1.13

References

https://gitlab.freedesktop.org/xorg/xserver/-/commit/fbf7...
patch
https://www.openwall.com/lists/oss-security/2026/07/08/2
vendor-advisory

CVSS V3.1

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Anonymous working with Trend Micro Zero Day Initiative.
.