Read the docs
TI-2026-40394 Aliases CVE-2026-55999GHSA-h655-847g-q4f7

xorg-server / xwayland glamor font atlas Heap Buffer Overflow

Priority LOW 39CWE-122Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-122 and the CVSS impact.

Summary

Local attackers with a X connection able to provide PCX fonts to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a heap buffer overflow via SetFont due to missing glyph boundary checks.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00333 26th percentileScored 2026-11-07
Fix Fixed xorg-server (X.Org): 21.1.24xwayland (X.Org): 24.1.13Red Hat: 18 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
x.orgxorg-serverbefore 21.1.2421.1.24Patch availableCNA
x.orgxwaylandbefore 24.1.1324.1.13Patch availableCNA
  • xorg-server Vendorx.org Affected before 21.1.24 Fixed in 21.1.24 Patch available CNA
  • xwayland Vendorx.org Affected before 24.1.13 Fixed in 24.1.13 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:x.org:x_server:*:*:*:*:*:*:*:*before 21.2.24Vulnerablex.org
cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:*before 24.1.13Vulnerablex.org
  • cpe:2.3:a:x.org:x_server:*:*:*:*:*:*:*:* Versions before 21.2.24 Vulnerable ·x.org
  • cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:* Versions before 24.1.13 Vulnerable ·x.org

Remediation

  • Fix · CNA xorg-server (X.Org) Fixed in 21.1.24
  • Fix · CNA xwayland (X.Org) Fixed in 24.1.13

Red Hat 18 advisories

  • RHSA-2026:53450 Released 2026-08-11 · Red Hat rating Important
    xorg-x11-server-Xwayland security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) xorg-x11-server-Xwayland-21.1.3-2.el8_6.8
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) xorg-x11-server-Xwayland-21.1.3-2.el8_6.8
  • RHSA-2026:52398 Released 2026-08-10 · Red Hat rating Important
    xorg-x11-server-Xwayland security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) xorg-x11-server-Xwayland-22.1.9-8.el9_4.3
  • RHSA-2026:52397 Released 2026-08-10 · Red Hat rating Important
    xorg-x11-server-Xwayland security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) xorg-x11-server-Xwayland-21.1.3-10.el9_2.2
Show 15 more Red Hat advisories
  • RHSA-2026:52392 Released 2026-08-10 · Red Hat rating Important
    xorg-x11-server-Xwayland security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) xorg-x11-server-Xwayland-21.1.3-13.el8_8.2
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) xorg-x11-server-Xwayland-21.1.3-13.el8_8.2
  • RHSA-2026:50718 Released 2026-08-05 · Red Hat rating Important
    xorg-x11-server-Xwayland security update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) xorg-x11-server-Xwayland-23.2.7-6.el9_6.3, xorg-x11-server-Xwayland-devel-23.2.7-6.el9_6.3
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) xorg-x11-server-Xwayland-23.2.7-6.el9_6.3
  • RHSA-2026:50117 Released 2026-08-04 · Red Hat rating Important
    xorg-x11-server security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) xorg-x11-server-1.20.4-36.el7_9, xorg-x11-server-Xephyr-1.20.4-36.el7_9, xorg-x11-server-Xorg-1.20.4-36.el7_9 +1
    • Red Hat Enterprise Linux Server Optional (v. 7 ELS) xorg-x11-server-Xdmx-1.20.4-36.el7_9, xorg-x11-server-Xnest-1.20.4-36.el7_9, xorg-x11-server-Xvfb-1.20.4-36.el7_9 +4
  • RHSA-2026:50116 Released 2026-08-04 · Red Hat rating Important
    xorg-x11-server security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) xorg-x11-server-1.20.11-19.el8_8.1, xorg-x11-server-Xdmx-1.20.11-19.el8_8.1, xorg-x11-server-Xephyr-1.20.11-19.el8_8.1 +4
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) xorg-x11-server-1.20.11-19.el8_8.1, xorg-x11-server-Xdmx-1.20.11-19.el8_8.1, xorg-x11-server-Xephyr-1.20.11-19.el8_8.1 +4
  • RHSA-2026:50100 Released 2026-08-04 · Red Hat rating Important
    xorg-x11-server-Xwayland security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) xorg-x11-server-Xwayland-24.1.5-6.el10_0.2
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) xorg-x11-server-Xwayland-devel-24.1.5-6.el10_0.2
  • RHSA-2026:49608 Released 2026-08-03 · Red Hat rating Important
    xorg-x11-server security update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) xorg-x11-server-devel-1.20.11-34.el9_6.1, xorg-x11-server-source-1.20.11-34.el9_6.1
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) xorg-x11-server-1.20.11-34.el9_6.1, xorg-x11-server-Xdmx-1.20.11-34.el9_6.1, xorg-x11-server-Xephyr-1.20.11-34.el9_6.1 +4
  • RHSA-2026:49606 Released 2026-08-03 · Red Hat rating Important
    xorg-x11-server security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) xorg-x11-server-1.20.10-5.el8_4.1, xorg-x11-server-Xdmx-1.20.10-5.el8_4.1, xorg-x11-server-Xephyr-1.20.10-5.el8_4.1 +5
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) xorg-x11-server-1.20.10-5.el8_4.1, xorg-x11-server-Xdmx-1.20.10-5.el8_4.1, xorg-x11-server-Xephyr-1.20.10-5.el8_4.1 +5
  • RHSA-2026:49605 Released 2026-08-03 · Red Hat rating Important
    xorg-x11-server security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) xorg-x11-server-1.20.11-8.el8_6.1, xorg-x11-server-Xdmx-1.20.11-8.el8_6.1, xorg-x11-server-Xephyr-1.20.11-8.el8_6.1 +4
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) xorg-x11-server-1.20.11-8.el8_6.1, xorg-x11-server-Xdmx-1.20.11-8.el8_6.1, xorg-x11-server-Xephyr-1.20.11-8.el8_6.1 +4
  • RHSA-2026:49516 Released 2026-08-03 · Red Hat rating Important
    xorg-x11-server security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) xorg-x11-server-1.20.11-29.el9_4.1, xorg-x11-server-Xdmx-1.20.11-29.el9_4.1, xorg-x11-server-Xephyr-1.20.11-29.el9_4.1 +4
  • RHSA-2026:49515 Released 2026-08-03 · Red Hat rating Important
    xorg-x11-server security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) xorg-x11-server-1.20.11-21.el9_2.1, xorg-x11-server-Xdmx-1.20.11-21.el9_2.1, xorg-x11-server-Xephyr-1.20.11-21.el9_2.1 +4
  • RHSA-2026:38486 Released 2026-07-13 · Red Hat rating Important
    xorg-x11-server security update
    • Red Hat Enterprise Linux AppStream (v. 9) xorg-x11-server-1.20.11-34.el9_8.3, xorg-x11-server-Xdmx-1.20.11-34.el9_8.3, xorg-x11-server-Xephyr-1.20.11-34.el9_8.3 +4
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) xorg-x11-server-devel-1.20.11-34.el9_8.3, xorg-x11-server-source-1.20.11-34.el9_8.3
  • RHSA-2026:38490 Released 2026-07-13 · Red Hat rating Important
    xorg-x11-server-Xwayland security update
    • Red Hat Enterprise Linux AppStream (v. 9) xorg-x11-server-Xwayland-24.1.9-4.el9_8.3
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) xorg-x11-server-Xwayland-24.1.9-4.el9_8.3, xorg-x11-server-Xwayland-devel-24.1.9-4.el9_8.3
  • RHSA-2026:38487 Released 2026-07-13 · Red Hat rating Important
    xorg-x11-server security update
    • Red Hat Enterprise Linux AppStream (v. 8) xorg-x11-server-1.20.11-28.el8_10.3, xorg-x11-server-Xdmx-1.20.11-28.el8_10.3, xorg-x11-server-Xephyr-1.20.11-28.el8_10.3 +4
    • Red Hat Enterprise Linux CRB (v. 8) xorg-x11-server-devel-1.20.11-28.el8_10.3, xorg-x11-server-source-1.20.11-28.el8_10.3
  • RHSA-2026:38489 Released 2026-07-13 · Red Hat rating Important
    xorg-x11-server-Xwayland security update
    • Red Hat Enterprise Linux AppStream (v. 10) xorg-x11-server-Xwayland-24.1.9-4.el10_2.3
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) xorg-x11-server-Xwayland-devel-24.1.9-4.el10_2.3
  • RHSA-2026:38488 Released 2026-07-13 · Red Hat rating Important
    xorg-x11-server-Xwayland security update
    • Red Hat Enterprise Linux AppStream (v. 8) xorg-x11-server-Xwayland-21.1.3-20.el8_10.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    X.Org xwayland — openwall.com/lists/oss-security/2026/07/08/2

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-40395 xorg-x11-server / xwayland GLX contextTags Use-After-Free in CommonMakeCurrent()Priority MEDIUM 41
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat CodeReady Linux Builder EUS (v.9.6)Fixed RHSA-2026:49608, RHSA-2026:50718
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:38489
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:38487, RHSA-2026:38488
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:38486, RHSA-2026:38490
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:49606
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:49605, RHSA-2026:53450
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:50116, RHSA-2026:52392
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:49515, RHSA-2026:52397
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:49516, RHSA-2026:52398
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:50100
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:49608, RHSA-2026:50718
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:49606
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)Fixed RHSA-2026:49605, RHSA-2026:53450
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:50116, RHSA-2026:52392
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2026:38487
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:38489
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:38486, RHSA-2026:38490
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)Fixed RHSA-2026:50100
Red Hat Enterprise Linux Server (v. 7 ELS)Fixed RHSA-2026:50117
Red Hat Enterprise Linux Server Optional (v. 7 ELS)Fixed RHSA-2026:50117
Not affected: 1 product
  • Red Hat Enterprise Linux 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55999
  2. 2026-10-03 Alias added: GHSA-h655-847g-q4f7

References

Patch 2

  • TI-2018-10528 A flaw was found in xorg-x11-server before 1.20.3. CVSS 3.0MEDIUM 6.6
  • TI-2017-08976 Improper input validation in x.org xorg-x11-server CVSS 3.0CRITICAL 9.8
  • TI-2017-08975 xorg-x11-server before 1.19.5 was missing length validation in MIT-SCREEN-SAVER extension… CVSS 3.0CRITICAL 9.8
  • TI-2017-08974 Improper input validation in x.org xorg-x11-server CVSS 3.0CRITICAL 9.8
  • TI-2017-08973 Improper input validation in x.org xorg-x11-server CVSS 3.0CRITICAL 9.8
  • TI-2017-08972 Improper input validation in x.org xorg-x11-server CVSS 3.0CRITICAL 9.8
See all 96 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences