Vulnerability intelligence

CVE-2026-55999

Local attackers with a X connection able to provide PCX fonts to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a heap buffer overflow via SetFont due to missing glyph boundary checks.

CVSS Score

8.5

High

EPSS — Exploit Probability

0.3%

Riskier than 19% of all CVEs

Exploitation

Not in CISA KEV

No federal exploitation record

Remediation

Patch available

Vendor fix published

NVD entry Vendor patch PoC / advisory

1 article across 1 outlet · first covered Jul 14, 2026 · latest Jul 14, 2026

Coverage timeline

Critical X.Org flaws patched, CVE‑2026‑56000 scores 9.0
securityonline.info · Jul 14, 2026