CVE-2026-55999
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
A vulnerability in Xorg server and Xwayland before versions 21.2.24 and 24.1.13 allows local attackers with an X connection to cause a heap buffer overflow via the SetFont function using crafted PCX fonts. Missing glyph boundary checks lead to buffer overflow.
Risk Assessment
A local attacker could exploit this vulnerability to execute arbitrary code in the context of the X server, potentially leading to privilege escalation or system instability.
Recommendation
Immediately update xorg-server to version 21.2.24 or later and xwayland to version 24.1.13 or later.
Original NVD description (English source)
Local attackers with a X connection able to provide PCX fonts to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a heap buffer overflow via SetFont due to missing glyph boundary checks.