Report feedback

An authenticated local attacker with an X connection capable of providing a PCF font can, due to a missing bounds check of font glyph metrics in the PCF file, cause a heap buffer overflow in xorg-server and xwayland and potentially cause DoS or execute arbitrary code [5][6].

The vulnerability is present in products:

• xorg-server; <21.1.24;
• xwayland; <24.1.13;

CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

• CVE-2026-55999 at cve.org, NVD
• CWE-122: Heap-based Buffer Overflow at cwe.mitre.org

The vulnerability was publicly disclosed 8. 7. 2026.

An authenticated local attacker with an X connection capable of sending a GLX commit can, in xorg-server and xwayland, use a specific GLX sequence to trigger a reallocation of a memory array without the corresponding pointer being updated in the code, so that it continues to point to already freed memory, and thereby potentially cause DoS or execute arbitrary code [5][7].

The vulnerability is present in products:

• xorg-server; <21.1.24;
• xwayland; <24.1.13;

CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

• CVE-2026-56000 at cve.org, NVD
• CWE-416: Use After Free at cwe.mitre.org

The vulnerability was publicly disclosed 8. 7. 2026.

An authenticated remote attacker can, by uploading a PCF file with excessive glyph dimensions, cause an overflow of a 32-bit variable in the libXfont2 library when calculating the size of allocated memory, which leads to a subsequent heap buffer overflow, potentially resulting in DoS or arbitrary code execution on the X server [8][9].

The vulnerability is present in product:

• libXfont2; <2.0.8;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

• CVE-2026-56001 at cve.org, NVD
• CWE-122: Heap-based Buffer Overflow at cwe.mitre.org

The vulnerability was publicly disclosed 8. 7. 2026.

An authenticated remote attacker can, by uploading a malicious PCF file, cause a heap buffer overflow in the libXfont2 library during parsing due to missing cross-validation of bitmap size and glyph metrics, which can potentially lead to DoS or arbitrary code execution on the X server [9][10].

The vulnerability is present in product:

• libXfont2; <2.0.8;

CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

More information:

• CVE-2026-56002 at cve.org, NVD
• CWE-122: Heap-based Buffer Overflow at cwe.mitre.org

The vulnerability was publicly disclosed 8. 7. 2026.

Autentizovanému vzdálenému útočníkovi je umožněno nahráním škodlivého PCF souboru s duplicitními vlastnostmi způsobit v knihovně libXfont2 přetečení vyrovnávací paměti na haldě z důvodu nedostatečného ověření mezí při zápisu do vyrovnávací paměti, čímž lze potenciálně vyvolat DoS či spustit libovolný kód na X serveru [9][11].

Zranitelnost se nachází v produktu:

• libXfont2; <2.0.8;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Více informací:

• CVE-2026-56003 na cve.org, NVD
• CWE-122: Heap-based Buffer Overflow na cwe.mitre.org

Zranitelnost byla veřejně oznámena 8. 7. 2026.