Executive brief
A vulnerability exists in the X.Org display server and Xwayland, which are fundamental components used to manage graphical user interfaces on Linux and Unix-like systems. An attacker with access to the system can provide a specially crafted font file that causes the display server to crash or potentially execute unauthorized code. This could lead to a complete system takeover or the theft of sensitive data displayed on the screen.
Technical details
A heap buffer overflow exists in the glamor_font_get() function of the X.Org server's glamor acceleration backend. The root cause is a failure to validate that individual glyph metrics in a Portable Compiled Format (PCF) font stay within the bounds of the font's declared 'maxbounds' property. When building a texture atlas, the server allocates memory based on 'maxbounds' but copies data based on the unverified per-glyph metrics, leading to an out-of-bounds write. An authenticated attacker can exploit this by setting a font path to a directory containing a crafted PCF file and requesting the server to load it. This affects Xorg with the modesetting driver and Xwayland. Patches are available in xorg-server 21.1.24 and xwayland 24.1.13.
Affected products
- X.Org xorg-server < 21.1.24
- X.Org xwayland < 24.1.13
Timeline
- 2026-07-08: disclosed
- 2026-07-08: advisory
- 2026-07-08: patched