CVE-2026-55999: X.Org Server Buffer Overflow Vulnerability

CVE-2026-55999 Overview

CVE-2026-55999 is a heap buffer overflow vulnerability [CWE-122] in the X.Org X server and Xwayland compositor. The flaw resides in the SetFont code path, which fails to enforce glyph boundary checks when processing PCF (PCX) fonts supplied by a client. A local attacker with an active X connection can provide a malformed font and trigger memory corruption in the server process. Affected versions are xorg-server before 21.2.24 and xwayland before 24.1.13. Because the X server frequently runs with elevated privileges, exploitation can lead to privilege escalation and compromise of the graphical session.

Critical Impact
Successful exploitation corrupts the X server heap, enabling code execution in the server context and compromising confidentiality, integrity, and availability of the graphical stack.

Affected Products

X.Org xorg-server versions prior to 21.2.24
xwayland versions prior to 24.1.13
Linux and Unix desktop distributions bundling the affected X server components

Discovery Timeline

2026-07-08 - CVE-2026-55999 published to NVD
2026-07-08 - Coordinated disclosure posted to the OpenWall OSS-Security Thread
2026-07-08 - Upstream fix published in the GitLab XServer Commit Update
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-55999

Vulnerability Analysis

The vulnerability is a heap buffer overflow in the SetFont handler used when the X server loads PCF bitmap fonts. The font loader parses glyph metric structures from an attacker-controlled font file but does not validate that individual glyph bounding boxes fall within the allocated glyph bitmap buffer. Writes derived from unchecked glyph dimensions extend past the end of the heap allocation, corrupting adjacent chunks and metadata.

Exploitation requires an authenticated X client connection, but modern desktops routinely grant that access to every user session. Because the compositor state is untrusted from the attacker's viewpoint, the impact scope changes and the attack affects components beyond the vulnerable process.

Root Cause

The root cause is missing glyph boundary validation during font ingestion. The parser trusts width, height, and offset fields declared in the PCF glyph table when computing write destinations. A crafted font that reports oversized glyph metrics causes the copy routine to write outside the allocated glyph buffer on the heap.

Attack Vector

An attacker with a local X connection submits a malicious PCF font through a font-loading request, triggering SetFont to process the crafted glyph table. Because the X server typically runs with higher privileges than the connecting client, heap corruption within the server can be steered toward arbitrary code execution or session takeover. No user interaction is required beyond the attacker's own client session.

No public proof-of-concept has been released. Technical details are available in the referenced upstream commit and the OSS-Security disclosure.

Detection Methods for CVE-2026-55999

Indicators of Compromise

Unexpected crashes or SIGSEGV termination of the Xorg or Xwayland process recorded in ~/.local/share/xorg/Xorg.*.log or journalctl
Custom or unsigned PCF font files written to user-writable directories such as /tmp, /var/tmp, or ~/.fonts
X client processes issuing OpenFont or SetFont requests referencing non-standard font paths shortly before an X server crash

Detection Strategies

Monitor process telemetry for abnormal termination of Xorg and Xwayland binaries and correlate with the parent user session
Alert on font file creation in user-writable locations followed by xset +fp or font-path modification commands
Inspect audit logs for execve calls invoking xset, fc-cache, or direct X client binaries loading fonts from non-system directories

Monitoring Recommendations

Enable coredump collection for X server processes and forward stack traces to a central log store for analysis
Track installed package versions of xorg-server and xwayland across the fleet and flag hosts running versions below 21.2.24 and 24.1.13
Baseline legitimate font paths per host and alert when new entries are added at runtime

How to Mitigate CVE-2026-55999

Immediate Actions Required

Upgrade xorg-server to 21.2.24 or later and xwayland to 24.1.13 or later using the distribution package manager
Restart affected graphical sessions after patching so the vulnerable server process is replaced
Restrict local shell access on multi-user systems until patches are deployed, since the flaw requires an active local X connection

Patch Information

The upstream fix adds the missing glyph boundary validation in the PCF font loader. Review the change in the GitLab XServer Commit Update and pull the corresponding distribution updates. Coordinated advisory details are in the OpenWall OSS-Security Thread.

Workarounds

Remove untrusted directories from the X server font path with xset -fp and reload with xset fp rehash
Prevent users from adding font paths at runtime by disabling AllowFontPath extensions in xorg.conf where feasible
On multi-user hosts, limit interactive access to the X server to trusted accounts until the update is applied

bash

# Verify installed versions and remove untrusted font paths
dpkg -l | grep -E 'xserver-xorg-core|xwayland'
xset q | sed -n '/Font Path/,/DPMS/p'
xset -fp /tmp,/var/tmp,$HOME/.fonts
xset fp rehash