Is CVE-2026-55999 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55999 being exploited in the wild.

How severe is CVE-2026-55999?

High severity, with a CVSS score of 8.5, published 8 July 2026.

Is there a fix for CVE-2026-55999?

A patch was published on 2026-07-08. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55999 attacked?

It is attacked over the network or with local access, in an operating system.

Am I affected by CVE-2026-55999?

Check whether you run X.Org Xorg-Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55999: X.Org xorg-server and xwayland heap buffer overflow in glamor font atlas

CVE-2026-55999 · Severity: high · CVSS 8.5 · Published 2026-07-08

A vulnerability exists in the X.Org display server and Xwayland, which are fundamental components used to manage graphical user interfaces on Linux and Unix-like systems. An attacker with access to the system can provide a specially crafted font file that causes the display server to crash or potentially execute unauthorized code. This could lead to a complete system takeover or the theft of sensitive data displayed on the screen.

Technologies: X.Org Xorg-Server. Vendors: X.Org.

Quick answers

Is CVE-2026-55999 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55999 being exploited in the wild.
How severe is CVE-2026-55999?: High severity, with a CVSS score of 8.5, published 8 July 2026.
Which products and versions are affected?: X.Org Xorg-Server < 21.1.24.
Is there a fix for CVE-2026-55999?: A patch was published on 2026-07-08. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55999 attacked?: It is attacked over the network or with local access, in an operating system.
Am I affected by CVE-2026-55999?: Check whether you run X.Org Xorg-Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap buffer overflow exists in the glamor_font_get() function of the X.Org server's glamor acceleration backend. The root cause is a failure to validate that individual glyph metrics in a Portable Compiled Format (PCF) font stay within the bounds of the font's declared 'maxbounds' property. When building a texture atlas, the server allocates memory based on 'maxbounds' but copies data based on the unverified per-glyph metrics, leading to an out-of-bounds write. An authenticated attacker can exploit this by setting a font path to a directory containing a crafted PCF file and requesting the server to load it. This affects Xorg with the modesetting driver and Xwayland. Patches are available in xorg-server 21.1.24 and xwayland 24.1.13.

Affected products

X.Org xorg-server < 21.1.24
X.Org xwayland < 24.1.13

Timeline

2026-07-08: disclosed
2026-07-08: advisory
2026-07-08: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.