High severity8.5NVD Advisory· Published Jul 8, 2026· Updated Jul 9, 2026
CVE-2026-55999
CVE-2026-55999
Description
Local attackers with a X connection able to provide PCX fonts to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a heap buffer overflow via SetFont due to missing glyph boundary checks.
Affected products
20- Range: <21.2.24
- osv-coords16 versionspkg:apk/chainguard/xorg-serverpkg:apk/wolfi/xorg-serverpkg:rpm/almalinux/xorg-x11-server-Xdmxpkg:rpm/almalinux/xorg-x11-server-Xephyrpkg:rpm/almalinux/xorg-x11-server-Xnestpkg:rpm/almalinux/xorg-x11-server-Xorgpkg:rpm/almalinux/xorg-x11-server-Xvfbpkg:rpm/almalinux/xorg-x11-server-Xwaylandpkg:rpm/almalinux/xorg-x11-server-Xwayland-develpkg:rpm/almalinux/xorg-x11-server-commonpkg:rpm/almalinux/xorg-x11-server-develpkg:rpm/almalinux/xorg-x11-server-sourcepkg:rpm/opensuse/xorg-x11-server&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/xorg-x11-server&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/xwayland&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/xwayland&distro=openSUSE%20Tumbleweed
< 21.1.24-r0+ 15 more
- (no CPE)range: < 21.1.24-r0
- (no CPE)range: < 21.1.24-r0
- (no CPE)range: < 1.20.11-34.el9_8.3
- (no CPE)range: < 1.20.11-34.el9_8.3
- (no CPE)range: < 1.20.11-34.el9_8.3
- (no CPE)range: < 1.20.11-34.el9_8.3
- (no CPE)range: < 1.20.11-34.el9_8.3
- (no CPE)range: < 21.1.3-20.el8_10.3
- (no CPE)range: < 24.1.9-4.el10_2.3
- (no CPE)range: < 1.20.11-34.el9_8.3
- (no CPE)range: < 1.20.11-34.el9_8.3
- (no CPE)range: < 1.20.11-34.el9_8.3
- (no CPE)range: < 21.1.15-160000.6.1
- (no CPE)range: < 21.1.21-8.1
- (no CPE)range: < 24.1.6-160000.6.1
- (no CPE)range: < 24.1.12-1.1
Patches
Vulnerability mechanics
References
2- gitlab.freedesktop.org/xorg/xserver/-/commit/fbf7bac22e2c6bd627fb042742a23318263edae1nvdPatch
- www.openwall.com/lists/oss-security/2026/07/08/2nvdMailing ListPatchThird Party Advisory
News mentions
0No linked articles in our index yet.