CVE-2026-55999: xorg-server / xwayland glamor font atlas Heap Buffer Overflow
glamorfontget() builds a per-font texture atlas by laying out every glyph in the font into a single backing buffer. It computes the slot dimensions from the font's declared maxbounds, but copies each per-glyph bitmap using the individual glyph's metrics (GLYPHHEIGHTPIXELS/GLYPHWIDTHBYTES macros). There is no check that maxbounds actually bounds the per-glyph values.
When the font is loaded from a malicious PCF file whose per-glyph metrics exceed the file's maxbounds, the per-glyph memcpy writes far beyond the heap-allocated slot, producing a heap buffer overflow with attacker-controlled extent and attacker-controlled content.
An authenticated X client can trigger this by using SetFontPath to add a directory containing a crafted PCF font, loading the font with OpenFont, and drawing text on a glamor-backed drawable. Only servers using the glamor acceleration backend (Xorg with modesetting driver, Xwayland) are affected.
Other sources
Local attackers with a X connection able to provide PCX fonts to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a heap buffer overflow via SetFont due to missing glyph boundary checks.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55999?
CVE-2026-55999 has a severity rating of high, with a score of 8.5.
How do I fix CVE-2026-55999?
To fix CVE-2026-55999, upgrade to xorg-server version 21.2.24 or later and xwayland version 24.1.13 or later.
What are the potential impacts of CVE-2026-55999?
CVE-2026-55999 can lead to a heap buffer overflow that may allow local attackers to execute arbitrary code.
Which software is affected by CVE-2026-55999?
CVE-2026-55999 affects xorg-server versions prior to 21.2.24 and xwayland versions prior to 24.1.13.
What type of vulnerability is CVE-2026-55999 classified as?
CVE-2026-55999 is classified as a Buffer Overflow vulnerability.