CVE-2026-55999: X.Org X Server Heap Buffer Overflow in PCX Font Handling

Technical summary

CVE-2026-55999 is a heap buffer overflow (CWE-122) affecting X.Org X server versions before 21.2.24 and XWayland versions before 24.1.13. The vulnerability resides in font handling logic where glyph boundary checks are missing or insufficient. When a local attacker with an established X connection supplies a malicious PCX font file and triggers the SetFont operation, the server writes beyond allocated heap memory. The CVSS 3.1 score of 8.5 (HIGH) reflects network-accessible impact despite local authentication requirements, suggesting potential for lateral movement or privilege escalation in multi-user or containerized environments.

Business impact

Organizations relying on X11 or Wayland display servers for shared workstations, remote access infrastructure, or containerized desktop environments face service disruption and potential lateral movement vectors. A compromised X server could allow an authenticated local user to escalate privileges, access other users' sessions, or pivot to additional systems. Enterprises with thin-client deployments, VDI solutions, or multi-user Linux systems should prioritize assessment and patching to prevent exploitation chains.

Affected systems

X.Org X server (xorg-server) versions prior to 21.2.24 and X.Org XWayland versions prior to 24.1.13 are vulnerable. This affects current and legacy Linux distributions shipping these X display servers, including but not limited to Debian, Ubuntu, Fedora, Red Hat, and SUSE variants. Systems using modern Wayland with XWayland compatibility layers are also in scope. Verify the exact version deployed in your environment against vendor advisories.

Exploitability

Exploitation requires local X connection access, which is typically available to any authenticated user on a shared system or container. The attack surface widens in scenarios with SSH access, container breakout paths, or guest VM environments where X forwarding is enabled. The CVSS vector (AV:N/AC:H/PR:L/UI:N) indicates that while network attack is possible under difficult conditions (AC:H), local exploitation is straightforward. No active exploit in the wild has been confirmed as of the KEV status (not on CISA KEV list), but the barrier to weaponization is relatively low.

Remediation

Upgrade xorg-server to version 21.2.24 or later, and XWayland to version 24.1.13 or later. Consult your distribution's security advisories for backported patches, as vendors may release updates before upstream version bumps. Temporary mitigation includes restricting X socket permissions, disabling X11 forwarding over SSH where not essential, and isolating untrusted users from shared X sessions. Validate patches against vendor release notes before deployment.

Patch guidance

Apply updates from your Linux distribution's security repositories. Major distributions typically backport fixes to stable releases; verify patch availability through your vendor's advisory channels (Red Hat Security Advisories, Debian Security Tracker, Ubuntu Security Notices, etc.). Test patches in non-production environments first, as X server updates may affect graphics performance or compatibility. If immediate patching is not feasible, implement access controls on X sockets and consider disabling X11 if not required for your workload.

Detection guidance

Monitor X server logs for unusual font operations or SetFont calls paired with malformed PCX headers. Correlate with process execution to identify suspicious font-loading patterns. Intrusion detection signatures should flag PCX font file deliveries to X servers from non-standard sources. Heap corruption may manifest as X server crashes or segmentation faults in syslog; cluster these events to identify attack attempts. Runtime application self-protection (RASP) or kernel-level memory tagging extensions (ARM MTE, Intel MPK) may catch exploitation attempts at the memory level.

Why prioritize this

HIGH severity with straightforward local exploitation paths warrants urgent prioritization for shared-user systems, VDI platforms, and container environments. The lack of CISA KEV listing suggests a narrower threat landscape currently, but the technical barrier to exploitation is low and the impact (code execution, privilege escalation) is severe. Organizations with multi-tenant Linux infrastructure or remote access solutions should treat this as critical.

Risk score, explained

CVSS 3.1 score of 8.5 reflects the combination of high impact (confidentiality, integrity, availability all affected), local but not difficult-to-satisfy prerequisites, and network-accessible code execution potential in certain configurations. The score appropriately captures the severity relative to other local privilege escalation vulnerabilities. Context-specific risk may vary: air-gapped single-user systems present minimal risk, while cloud VDI or shared academic compute clusters present significantly higher risk.

Frequently asked questions