Xwayland EUVD-2026-42188

| CVE-2026-55999 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-07-08

GHSA-h655-847g-q4f7

Buffer Overflow Heap Overflow Red Hat X Server Xwayland Suse X Org

7.8

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness

CWE

ASVS 5.0

V15 - Secure Coding and Architecture Heap buffer bounds checking

MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

AnalysisAIv3 – Jul 09, 2026

Local privilege escalation via heap buffer overflow in the X.Org Server (versions before 21.1.24) and Xwayland (before 24.1.13) allows a local user holding an X connection to corrupt heap memory by supplying a malicious PCX font. The flaw lives in the SetFont code path, where missing glyph boundary checks let an oversized or malformed glyph write past its heap allocation, yielding full confidentiality, integrity, and availability impact (CVSS 7.8). There is no public exploit identified at time of analysis; EPSS is low at 0.28% and CISA SSVC rates exploitation as none.

Earlier versions of this analysis (2)

v2 Jul 09, 2026 - 19:58 cvss changed CVSS 7.8

Heap buffer overflow in the X.Org Server (before 21.1.24) and Xwayland (before 24.1.13) allows a local attacker holding an X connection to corrupt heap memory by supplying malicious PCX fonts, potentially leading to code execution or a server crash. The flaw lives in the SetFont code path, where glyph boundary checks are missing (CWE-122). There is no public exploit identified at time of analysis, EPSS is low (0.28%), and CISA SSVC rates exploitation as none, though technical impact is total.

v1 Jul 08, 2026 - 02:19

Heap buffer overflow in the glamor font atlas builder in X.Org X server and Xwayland allows an authenticated X client to achieve attacker-controlled heap corruption by loading a specially crafted PCF font file. The vulnerable function glamor_font_get() allocates an atlas buffer sized from the font-level maxbounds metric but copies per-glyph bitmaps using individual glyph metrics without validating them against maxbounds, permitting a crafted PCF file to drive memcpy writes with attacker-controlled size and content far beyond the allocated heap region. No public exploit has been identified at time of analysis, though the issue was reported through Trend Micro Zero Day Initiative (ZDI-CAN-30498); vendor-released patches exist in xorg-server-21.1.24 and xwayland-24.1.13.

Affected VersionsENISA

xorg-server 0 <21.1.24

xwayland 0 <24.1.13

Affected Packages

euvd xorg_server fix: 21.1.24

euvd xwayland fix: 24.1.13

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Xwayland gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (CNA) PRIMARY HIGH

NVD 7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 7.8 HIGH

Local X connection required (AV:L, PR:L) with no victim interaction (UI:N); heap corruption in the display server yields high C/I/A and no scope change.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE 7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Red Hat 7.5 HIGH

Primary rating from Vendor (CNA).

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

4

Analysis Updated

Jul 09, 2026 - 19:59 vuln.today

v3 - CVSS changed

Analysis Updated

Jul 09, 2026 - 19:58 vuln.today

v2 - CVSS changed

CVSS changed

Jul 09, 2026 - 19:52 NVD

8.5 (HIGH) 7.8 (HIGH)

Patch available

Jul 08, 2026 - 09:01 EUVD

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Zero Day Initiative Advisories

ZDI-26-409 X.Org Server Glamor Font Heap-based Buffer Overflow Privilege Escalation Vulnerability Jul 2026

Executive ViewAI

Why It Matters

A high-severity privilege escalation vulnerability in X.Org Server and Xwayland could allow attackers with local system access to gain unauthorized control and access sensitive data, posing a material risk to desktop and development environments. The vulnerability affects X.Org Server versions before 21.1.24 and Xwayland before 24.1.13, with no public exploit identified at time of analysis. Immediate patching is critical to prevent potential data breaches and system compromise across affected infrastructure.

Recommended Action

Within 24 hours: Identify all systems running X.Org Server (versions before 21.1.24) or Xwayland (before 24.1.13) and assess exposure across desktop and development workstations. Within 7 days: Prioritize patch deployment on systems holding sensitive data or development credentials; upgrade X.Org Server to 21.1.24 or later and Xwayland to 24.1.13 or later. Within 30 days: Complete patch rollout across all affected systems and conduct verification scans to confirm no vulnerable versions remain.

Business Impact: High

Compensating Controls

Vendor-released patch: X.Org Server 21.1.24 and Xwayland 24.1.13

Threat Intelligence Overview

EPSS Score

0.3%

Top 80% exploitable

Data Quality

6 sources

Confidence: High

EUVD

CVE.org

EPSS

Vulnrichment MSRC Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.3%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Small

Automatable

No

Human Impact

High

Technical Impact

Total

Priority Score

39

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +39

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Heap Overflow HIGH

A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.

Related Vulnerabilities in X.Org X Server and Xwayland Security Flaws

View all 2

CVE-2026-56000 CRITICAL

More in Xwayland

View all

CVE-2023-6816 CRITICAL Act Now

A heap overflow vulnerability exists in X.Org Server and Xwayland where improper memory allocation for logical button ma

CVE-2023-5367 HIGH This Week

A out-of-bounds write flaw was found in the xorg-x11-server. Rated high severity (CVSS 7.8), this vulnerability is low a

CVE-2023-6377 HIGH This Week

A flaw was found in xorg-server. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Out-o

CVE-2023-6478 HIGH This Week

A flaw was found in xorg-server. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authenti

CVE-2025-26598 HIGH This Week

An out-of-bounds write flaw was found in X.Org and Xwayland. Rated high severity (CVSS 7.8), this vulnerability is low a

CVE-2025-26601 HIGH This Week

A use-after-free flaw was found in X.Org and Xwayland. Rated high severity (CVSS 7.8), this vulnerability is low attack

CVE-2025-26600 HIGH This Week

A use-after-free flaw was found in X.Org and Xwayland. Rated high severity (CVSS 7.8), this vulnerability is low attack

CVE-2025-26599 HIGH This Week

An access to an uninitialized pointer flaw was found in X.Org and Xwayland. Rated high severity (CVSS 7.8), this vulnera

CVE-2025-26597 HIGH This Week

A buffer overflow flaw was found in X.Org and Xwayland. Rated high severity (CVSS 7.8), this vulnerability is low attack

CVE-2025-26596 HIGH This Week

A heap overflow flaw was found in X.Org and Xwayland. Rated high severity (CVSS 7.8), this vulnerability is low attack c

CVE-2025-26595 HIGH This Week

A buffer overflow flaw was found in X.Org and Xwayland. Rated high severity (CVSS 7.8), this vulnerability is low attack

Same weakness CWE-122 – Heap-based Buffer Overflow

View all

CVE-2023-4911 HIGH POC

CVE-2023-27997 CRITICAL

CVE-2026-94127 CRITICAL POC

CVE-2025-25249 CRITICAL POC

CVE-2026-85880 HIGH POC

CVE-2025-24985 HIGH POC

CVE-2026-53362 HIGH POC

CVE-2025-21418 HIGH

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

CVE-2015-5119 CRITICAL POC

CVE-2015-3113 CRITICAL POC

CVE-2011-2462 CRITICAL POC

CVE-2020-0796 CRITICAL POC

CVE-2019-11043 CRITICAL POC

CVE-2009-0927 HIGH POC

CVE-2012-1889 HIGH POC

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
Container suse/kiosk/xorg:21.1-82.11	Affected
SUSE Liberty Linux 10	Fixed
SUSE Liberty Linux 8	Fixed
SUSE Liberty Linux 9	Fixed
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed

References

Advisories & patches

ADVISORY https://access.redhat.com/errata/RHSA-2026:38486 ADVISORY https://access.redhat.com/errata/RHSA-2026:38487 ADVISORY https://access.redhat.com/errata/RHSA-2026:38488 ADVISORY https://access.redhat.com/errata/RHSA-2026:38489 ADVISORY https://access.redhat.com/errata/RHSA-2026:38490 ADVISORY https://gitlab.freedesktop.org/xorg/xserver/-/commit/2779affbdb4354e894f490e56f962527d6125043 ADVISORY https://gitlab.freedesktop.org/xorg/xserver/-/commit/fbf7bac22e2c6bd627fb042742a23318263edae1 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-55999 ADVISORY https://seclists.org/oss-sec/2026/q3/94 ADVISORY https://vuldb.com/vuln/376809 ADVISORY https://www.openwall.com/lists/oss-security/2026/07/08/2 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22617/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2786/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2787/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2788/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2789/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2791/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2792/

Search Externally

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy