CVE-2026-55999

7.8 highEPSS 0.3%

High (7.8) in x.org. EPSS 0.3% chance of exploitation in the next 30 days.

Local attackers with a X connection able to provide PCX fonts to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a heap buffer overflow via SetFont due to missing glyph boundary checks.

Severity

CVSS 3.1

7.8 high

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 26% of CVEs (scores of 2026-10-31)
CWE: CWE-122
Published: 2026-07-08
Modified: 2026-07-09
Record from: the NVD, synced 2026-10-19

Affected

x.org:x_server
x.org:xwayland

References

https://gitlab.freedesktop.org/xorg/xserver/-/commit/fbf7bac22e2c6bd627fb042742a23318263edae1
https://www.openwall.com/lists/oss-security/2026/07/08/2

Check your stack JSON