CVE-2026-55999

HIGH 8.5

xorg-server / xwayland glamor font atlas Heap Buffer Overflow

CVSS Score

8.5

EPSS Score

0.3%

EPSS Percentile

20th

Local attackers with a X connection able to provide PCX fonts to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a heap buffer overflow via SetFont due to missing glyph boundary checks.

CWE	CWE-122
Vendor	x.org
Product	xorg-server
Published	Jul 8, 2026
Last Updated	Jul 9, 2026

Stay Ahead of the Next One

Get instant alerts for x.org xorg-server

Be the first to know when new high vulnerabilities affecting x.org xorg-server are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

X.Org / xorg-server

0 < 21.1.24

X.Org / xwayland

0 < 24.1.13

References

NVD ↗ CVE.org ↗ EPSS Data ↗

gitlab.freedesktop.org: https://gitlab.freedesktop.org/xorg/xserver/-/commit/fbf7bac22e2c6bd627fb042742a23318263edae1 openwall.com: https://www.openwall.com/lists/oss-security/2026/07/08/2

Credits

Anonymous working with Trend Micro Zero Day Initiative.