What is the CVSS score of CVE-2026-55999?

CVE-2026-55999 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of X Server are affected by CVE-2026-55999?

A high-severity privilege escalation vulnerability in X.Org Server and Xwayland could allow attackers with local system access to gain unauthorized control and access sensitive data, posing a…. A patch is available.

How to fix or mitigate CVE-2026-55999?

Within 24 hours: Identify all systems running X.Org Server (versions before 21.1.24) or Xwayland (before 24.1.13) and assess exposure across desktop and development workstations. Within 7 days: Prioritize patch deployment on systems holding sensitive data or development credentials; upgrade X.Org Server to 21.1.24 or later and Xwayland to 24.1.13 or later. Within 30 days: Complete patch rollout across all affected systems and conduct verification scans to confirm no vulnerable versions remain.

X Server CVE-2026-55999

EUVD-2026-42188 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-07-08

GHSA-h655-847g-q4f7

Buffer Overflow Heap Overflow X Server Xwayland Red Hat Suse

7.8

CVSS 3.1 · NVD

Severity by source

Vendor (CNA) PRIMARY

HIGH

qualitative

NVD

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local X connection required (AV:L, PR:L) with no victim interaction (UI:N); heap corruption in the display server yields high C/I/A and no scope change.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (CNA).

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 09, 2026 - 19:59 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 09, 2026 - 19:58 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 09, 2026 - 19:52 vuln.today

cvss_changed

CVSS changed

Jul 09, 2026 - 19:52 NVD

8.5 (HIGH) 7.8 (HIGH)

Patch available

Jul 08, 2026 - 09:01 EUVD

Analysis Generated

Jul 08, 2026 - 02:19 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Local privilege escalation via heap buffer overflow in the X.Org Server (versions before 21.1.24) and Xwayland (before 24.1.13) allows a local user holding an X connection to corrupt heap memory by supplying a malicious PCX font. The flaw lives in the SetFont code path, where missing glyph boundary checks let an oversized or malformed glyph write past its heap allocation, yielding full confidentiality, integrity, and availability impact (CVSS 7.8). There is no public exploit identified at time of analysis; EPSS is low at 0.28% and CISA SSVC rates exploitation as none.

More in X Server

View all

CVE-2018-14665 MEDIUM This Month POC

6.6 Oct 25

A flaw was found in xorg-x11-server before 1.20.3. Rated medium severity (CVSS 6.6), this vulnerability is low attack co

CVE-2019-17624 HIGH This Week POC

7.8 Oct 16

"" In X.Org X Server 1.20.4, there is a stack-based buffer overflow in the function XQueryKeymap. Rated high severity (C

CVE-2017-10971 HIGH This Week

8.8 Jul 06

In the X.Org X server before 2017-06-19, a user authenticated to an X Session could crash or execute code in the context

CVE-2026-56000 CRITICAL Act Now

9.0 Jul 08

Use-after-free in the GLX dispatch layer of X.Org X Server and Xwayland allows an authenticated X client to corrupt heap

CVE-2022-46344 HIGH This Week

8.8 Dec 14