CVE-2026-55999: X.org X Server

High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days.

Local attackers with a X connection able to provide PCX fonts to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a heap buffer overflow via SetFont due to missing glyph boundary checks.

Affected products

• X.org X Server: before 21.2.24 (fixed in 21.2.24)
• X.org Xwayland: before 24.1.13 (fixed in 24.1.13)

Published 2026-07-08. Last modified 2026-07-09.