X.Org fixes five memory-corruption flaws in X server, Xwayland, and libXfont2

X.Org released security updates for X.Org Server 21.1.24, Xwayland 24.1.13, and libXfont2 2.0.8 to address five vulnerabilities tied largely to malformed PCF fonts and unsafe graphics context handling. The X server and Xwayland fixes cover CVE-2026-55999, a heap buffer overflow in glamor font atlas handling that an authenticated X client can trigger with a crafted PCF font on glamor-backed servers, and CVE-2026-56000, a use-after-free in CommonMakeCurrent() involving GLX contextTags that can be reached through malicious GLX context creation and MakeCurrent requests.

The libXfont2 update fixes CVE-2026-56001, an integer-overflow-driven heap buffer overflow in BitmapScaleBitmaps(); CVE-2026-56002, a heap buffer overflow in pcfReadFont() during PCF parsing; and CVE-2026-56003, a heap buffer overflow in ComputeScaledProperties() caused by an unchecked fixed-size property buffer. X.Org said the flaws were reported anonymously through Trend Micro's Zero Day Initiative, and downstream reporting warned the bugs could enable privilege escalation or potentially remote code execution where the X server runs as root or where X11 forwarding is exposed over SSH.