Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.5
CVE-2026-55999: Xorg Server and Xwayland may crash when handling PCX fonts
CVE-2026-55999 · published 3 months ago
Summary
The Xorg display server and its Xwayland component can be forced to overflow memory when a local user supplies specially crafted PCX font files. This could cause the server to stop working or become unstable, potentially affecting any applications that rely on the graphical interface. Update the Xorg and Xwayland packages to the latest versions that include the fix, or avoid loading untrusted PCX fonts.
What to do
- Update bellsoft xorg-server to version 21.1.24-r0.
- Update debian xwayland to version 2:24.1.13-1.
- Update debian rootio-xorg-server to version 2:21.1.7-3+deb12u12.root.io.7.
- Update debian xorg-server to version 2:21.1.7-3+deb12u12.aikido.8.
- Update debian rootio-xorg-server to version 2:21.1.7-3+deb12u12.aikido.8.
- Update debian xorg-server to version 2:21.1.24-1.
- Update debian xorg-server to version 2:21.1.16-1.3+deb13u4.
- Update xorg-server to version 2:1.20.11-1+deb11u13.aikido.11.
- Update rootio-xorg-server to version 2:1.20.11-1+deb11u13.aikido.11.
- Update xorg-server to version 2:1.20.11-1+deb11u13.aikido.12.
- Update rootio-xorg-server to version 2:1.20.11-1+deb11u13.aikido.12.
- Update xorg-server to version 2:1.20.11-1+deb11u18.aikido.13.
- Update rootio-xorg-server to version 2:1.20.11-1+deb11u18.aikido.13.
- Update x.org xorg-server to version 21.1.24 or later.
- Update x.org xwayland to version 24.1.13 or later.
- Update x.org x_server to version 21.2.24 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:11 | debian | xorg-server | All versions |
| Debian:12 | debian | xorg-server | All versions |
| Debian:13 | debian | xorg-server |
< 2:21.1.16-1.3+deb13u4 Fix: upgrade to 2:21.1.16-1.3+deb13u4
|
| Debian:14 | debian | xorg-server |
< 2:21.1.24-1 Fix: upgrade to 2:21.1.24-1
|
| Debian:12 | debian | xwayland | All versions |
| Debian:13 | debian | xwayland | All versions |
| Debian:14 | debian | xwayland |
< 2:24.1.13-1 Fix: upgrade to 2:24.1.13-1
|
| Alpaquita:25 | bellsoft | xorg-server |
>= 21.1.16-r0, < 21.1.24-r0 Fix: upgrade to 21.1.24-r0
|
| – | x.org | xorg-server | < 21.1.24 |
| – | x.org | xwayland | < 24.1.13 |
| Alpaquita:stream | bellsoft | xorg-server |
>= 21.1.4-r1, < 21.1.24-r0 Fix: upgrade to 21.1.24-r0
|
| – | x.org | x_server |
< 21.2.24 cpe:2.3:a:x.org:x_server:*:*:*:*:*:*:*:* |
| Root:Debian:12 | debian | rootio-xorg-server |
< 2:21.1.7-3+deb12u12.root.io.7 < 2:21.1.7-3+deb12u12.aikido.8 Fix: upgrade to 2:21.1.7-3+deb12u12.root.io.7
|
| Root:Debian:12 | debian | xorg-server |
< 2:21.1.7-3+deb12u12.aikido.8 Fix: upgrade to 2:21.1.7-3+deb12u12.aikido.8
|
| Ubuntu:Pro:14.04:LTS | canonical | xorg-server | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | xorg-server-hwe-16.04 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | xorg-server-hwe-18.04 | All versions |
| Ubuntu:22.04:LTS | canonical | xwayland | All versions |
| Root:Debian:11 | – | xorg-server |
< 2:1.20.11-1+deb11u13.aikido.11 < 2:1.20.11-1+deb11u13.aikido.12 < 2:1.20.11-1+deb11u18.aikido.13 Fix: upgrade to 2:1.20.11-1+deb11u13.aikido.11
|
| Root:Debian:11 | – | rootio-xorg-server |
< 2:1.20.11-1+deb11u13.aikido.11 < 2:1.20.11-1+deb11u13.aikido.12 < 2:1.20.11-1+deb11u18.aikido.13 Fix: upgrade to 2:1.20.11-1+deb11u13.aikido.11
|
Original advisory text
xorg-server / xwayland glamor font atlas Heap Buffer Overflow
Local attackers with a X connection able to provide PCX fonts to the X
server xorg-server before 21.2.24 and xwayland before 24.1.13 could
cause a heap buffer overflow via SetFont due to missing glyph boundary checks.
server xorg-server before 21.2.24 and xwayland before 24.1.13 could
cause a heap buffer overflow via SetFont due to missing glyph boundary checks.
References
- https://docs.bell-sw.com/security/cves/CVE-2026-55999 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55999... Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-55999 Vendor Advisory
- https://www.openwall.com/lists/oss-security/2026/07/08/2 Vendor Advisory
- https://gitlab.freedesktop.org/xorg/xserver/-/commit/fbf7bac22e2c6bd627fb042742a... Patch
- https://ubuntu.com/security/CVE-2026-55999 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-55999 Third Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-55999 Vendor Advisory
- https://gitlab.freedesktop.org/xorg/xserver/ Product
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-122Heap-based Buffer Overflow
Timeline
Published8 Jul 2026
Updated4 Nov 2026
First seen8 Jul 2026
Sources
CVE-2026-55999 · NVD
CVE-2026-55999 · MITRE
DEBIAN-CVE-2026-55999 · OSV
BELL-CVE-2026-55999 · OSV
CVE-2026-55999 · OSV
UBUNTU-CVE-2026-55999 · OSV
Track software like this
Free during beta