Loading story…
X.Org released security updates for X.Org Server 21.1.24, Xwayland 24.1.13, and libXfont2 2.0.8 to address five vulnerabilities tied largely to malformed PCF fonts and unsafe graphics context handling. The X server and Xwayland fixes cover CVE-2026-55999, a heap buffer overflow in glamor font atlas handling that an authenticated X client can trigger with a crafted PCF font on glamor-backed servers, and CVE-2026-56000, a use-after-free in CommonMakeCurrent() involving GLX contextTags that can be reached through malicious GLX context creation and MakeCurrent requests.
The libXfont2 update fixes CVE-2026-56001, an integer-overflow-driven heap buffer overflow in BitmapScaleBitmaps(); CVE-2026-56002, a heap buffer overflow in pcfReadFont() during PCF parsing; and CVE-2026-56003, a heap buffer overflow in ComputeScaledProperties() caused by an unchecked fixed-size property buffer. X.Org said the flaws were reported anonymously through Trend Micro's Zero Day Initiative, and downstream reporting warned the bugs could enable privilege escalation or potentially remote code execution where the X server runs as root or where X11 forwarding is exposed over SSH.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
X.Org disclosed CVE-2026-56001, CVE-2026-56002, and CVE-2026-56003 in libXfont2 versions prior to 2.0.8 and released fixes in libXfont2-2.0.8. The vulnerabilities involve malformed PCF font handling and were found by an anonymous researcher working with Trend Micro Zero Day Initiative.
X.Org disclosed CVE-2026-55999 and CVE-2026-56000 affecting X.Org X server before 21.1.24 and Xwayland before 24.1.13. The issues were fixed in xorg-server-21.1.24 and xwayland-24.1.13, and the vulnerabilities were reported anonymously through Trend Micro Zero Day Initiative.
X.Org committed a security fix in xserver's glamor font rendering code for CVE-2026-55999, rejecting malformed PCF fonts whose per-glyph metrics are negative or exceed maxbounds-derived atlas slot sizes and falling back to software rendering. The commit also added tests and a minimal malicious PCF builder to verify crafted fonts no longer crash the server.
X.Org published a security advisory covering multiple security issues affecting X.Org X server and Xwayland. This advisory predates the later July 2026 public disclosure and release entries already in the timeline.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
16 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourceseclists.org
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcegitlab.freedesktop.org
Open sourcegitlab.freedesktop.org
Open sourcegitlab.freedesktop.org
Open sourceopennet.me
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
X.Org disclosed **nine security vulnerabilities** in the X server and Xwayland and released fixes in **`xorg-server 21.1.23`** and **`xwayland 24.1.12`**. The bugs, later assigned **`CVE-2026-50256`** through **`CVE-2026-50264`**, affect versions prior to those releases and span multiple subsystems including **libXfont2/font alias handling, XSYNC, XKB, GLX, screensaver code, and DRI2**. Reported impacts include crashes, information disclosure, memory corruption, and possible **privilege escalation** where the X server runs as root; some reports also note potential **remote code execution** exposure in environments using **SSH X11 forwarding**. Most issues were reported by an anonymous researcher working with TrendAI Zero Day Initiative, while one DRI2 flaw was credited to Peter Hutterer of Red Hat. The fixes address several distinct bug classes: a **stack-based buffer overflow** caused by a font-name length mismatch during alias resolution, multiple **use-after-free** conditions in XSYNC object teardown and `CreateSaverWindow`, stricter GLX request-size validation to stop malformed client requests from reaching unsafe paths, and DRI2 hardening to validate and deduplicate buffer attachments before allocation and processing. One disclosed flaw, tracked as **`CVE-2026-50256`**, allows any client able to connect to the server to trigger a font-alias overflow that could lead to denial of service or elevated impact on root-run servers. Red Hat separately rated affected X.Org server packages as **Important** across supported RHEL releases, underscoring the need to update exposed X.Org and Xwayland deployments.
Jun 29, 2026
X.Org released **libXfont2 2.0.9** to fix two memory-corruption flaws in the font-server client: **CVE-2026-59679**, an out-of-bounds heap read/write caused by inconsistent character and extent counts in font-server replies, and **CVE-2026-44950**, a heap-buffer overflow in `fs_read_glyphs()` caused by cumulative glyph bitmap writes exceeding the allocated buffer. A malicious font server can exploit either vulnerability to crash an unprivileged X server or potentially gain elevated privileges where the X server runs as root; both issues are incomplete fixes for **CVE-2014-0210**. Red Hat has issued Important security updates for affected RHEL 10 and RHEL 9 SAP-related Update Services and lifecycle channels. Fixed packages include **libXfont2 2.0.6-5.el10_2.3** for RHEL 10, **2.0.3-12.el9_4.3** for RHEL 9.4 channels, and **2.0.3-12.el9_2.3** for RHEL 9.2 channels, covering supported x86_64, aarch64, ppc64le, s390x, and, where applicable, i686 systems. Organizations should apply the relevant vendor updates, particularly on systems operating X servers with root privileges.
Sep 1, 2026
X.Org Server **26.1** has been released as the project’s first major feature update in roughly five years, succeeding the 21.1 series and marking a significant refresh of the long-running display server stack. The release, identified in one report as `xorg-server 26.0.99.901`, replaces the legacy Autoconf/Automake build system with **Meson** and introduces protocol and platform updates including **DPMS 1.2** event support, **XFixes 6.1**, BSD DRM platform support, and expanded **Xvfb** capabilities. The update also brings several security-relevant hardening changes across X.Org-based servers including **Xorg, Xephyr, Xnest, Xvfb, Xwin, and Xquartz**. Reports say the server now **disallows byte-swapped clients by default** and **disables font server connections by default**, while also changing log storage behavior for rootless mode and removing older components such as **DMX**, **EXA**, and shadow pixmap code. Xorg additionally now requires `libpciaccess 0.19` because of a new API dependency, reflecting broader modernization of the codebase alongside the security improvements.
Aug 20, 2026