CVE-2026-55999
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
A vulnerability in Xorg server and Xwayland before versions 21.2.24 and 24.1.13 allows local attackers with an X connection to cause a heap buffer overflow via the SetFont function using crafted PCX fonts. Missing glyph boundary checks lead to buffer overflow.
Risk Assessment
A local attacker could exploit this vulnerability to execute arbitrary code in the context of the X server, potentially leading to privilege escalation or system instability.
Recommendation
Immediately update xorg-server to version 21.2.24 or later and xwayland to version 24.1.13 or later.
Other vulnerabilities in Xorg-server
See all- CVE-2026-56000High
A vulnerability in Xorg server and Xwayland allows local attackers with an X connection to trigger a Heap Use-After-Free via the CommonMakeCurrent() function, which may point to potentially reallocated memory.
- CVE-2023-6478High
A flaw was found in xorg-server that can be triggered by a specially crafted request to RRChangeProviderProperty or RRChangeOutputProperty. This may lead to an integer overflow, potentially resulting in the disclosure of sensitive information.
- CVE-2023-6377High
A flaw was found in xorg-server that allows for out-of-bounds memory reads and writes when querying or changing XKB button actions, such as moving from a touchpad to a mouse. This may lead to local privilege escalation or possible remote code execution in cases where X11 forwarding is involved.
Original NVD description (English source)
Local attackers with a X connection able to provide PCX fonts to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a heap buffer overflow via SetFont due to missing glyph boundary checks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS