# CVE-2026-55999: X.Org xorg-server and xwayland heap buffer overflow in glamor font atlas

Source: https://junglewise.ai/threats/cve-2026-55999-x-org-xorg-server-and-xwayland-heap-buffer-overflow-in-glamor  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-55999 · Severity: high · CVSS 8.5 · Published 2026-07-08

A vulnerability exists in the X.Org display server and Xwayland, which are fundamental components used to manage graphical user interfaces on Linux and Unix-like systems. An attacker with access to the system can provide a specially crafted font file that causes the display server to crash or potentially execute unauthorized code. This could lead to a complete system takeover or the theft of sensitive data displayed on the screen.

Technologies: [X.Org Xorg-Server](https://junglewise.ai/threats/technologies/xorg-server). Vendors: [X.Org](https://junglewise.ai/threats/vendors/x-org).

## Quick answers

**Is CVE-2026-55999 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55999 being exploited in the wild.

**How severe is CVE-2026-55999?** High severity, with a CVSS score of 8.5, published 8 July 2026.

**Which products and versions are affected?** X.Org Xorg-Server < 21.1.24.

**Is there a fix for CVE-2026-55999?** A patch was published on 2026-07-08. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55999 attacked?** It is attacked over the network or with local access, in an operating system.

**Am I affected by CVE-2026-55999?** Check whether you run X.Org Xorg-Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap buffer overflow exists in the glamor_font_get() function of the X.Org server's glamor acceleration backend. The root cause is a failure to validate that individual glyph metrics in a Portable Compiled Format (PCF) font stay within the bounds of the font's declared 'maxbounds' property. When building a texture atlas, the server allocates memory based on 'maxbounds' but copies data based on the unverified per-glyph metrics, leading to an out-of-bounds write. An authenticated attacker can exploit this by setting a font path to a directory containing a crafted PCF file and requesting the server to load it. This affects Xorg with the modesetting driver and Xwayland. Patches are available in xorg-server 21.1.24 and xwayland 24.1.13.

## Affected products

- X.Org xorg-server < 21.1.24
- X.Org xwayland < 24.1.13

## Timeline

- 2026-07-08: disclosed
- 2026-07-08: advisory
- 2026-07-08: patched

## References

- [https://gitlab.freedesktop.org/xorg/xserver/-/commit/fbf7bac22e2c6bd627fb042742a23318263edae1](https://gitlab.freedesktop.org/xorg/xserver/-/commit/fbf7bac22e2c6bd627fb042742a23318263edae1)
- [https://www.openwall.com/lists/oss-security/2026/07/08/2](https://www.openwall.com/lists/oss-security/2026/07/08/2)

## Related threats

- [X.Org xorg-server and xwayland heap use-after-free in GLX CommonMakeCurrent](https://junglewise.ai/threats/cve-2026-56000-x-org-xorg-server-and-xwayland-heap-use-after-free-in-glx)
- [X.Org X server and Xwayland use-after-free in CreateSaverWindow](https://junglewise.ai/threats/cve-2026-50263-x-org-x-server-and-xwayland-use-after-free-in-createsaverwindow)