Loading story…
X.Org Server 26.1 has been released as the project’s first major feature update in roughly five years, succeeding the 21.1 series and marking a significant refresh of the long-running display server stack. The release, identified in one report as xorg-server 26.0.99.901, replaces the legacy Autoconf/Automake build system with Meson and introduces protocol and platform updates including DPMS 1.2 event support, XFixes 6.1, BSD DRM platform support, and expanded Xvfb capabilities.
The update also brings several security-relevant hardening changes across X.Org-based servers including Xorg, Xephyr, Xnest, Xvfb, Xwin, and Xquartz. Reports say the server now disallows byte-swapped clients by default and disables font server connections by default, while also changing log storage behavior for rootless mode and removing older components such as DMX, EXA, and shadow pixmap code. Xorg additionally now requires libpciaccess 0.19 because of a new API dependency, reflecting broader modernization of the codebase alongside the security improvements.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
The same day as the X.Org Server 26.1 RC1 announcement, XWayland 26.1 RC1 was also released. The reference notes X.Org Server 26.1 was less feature-rich than the XWayland 26.1 work in development.
X.Org Server 26.1 RC1 was tagged on 19 August 2026 as the first major feature release candidate for xorg-server in five years. The release candidate includes security-relevant hardening such as disallowing byte-swapped clients by default and disabling font server connections by default, alongside the Meson-only build transition and other updates.
The references identify the 21.1 branch as the prior major X.Org Server line and state it was released in 2021. Later 26.1 is described as the first major update since this branch.
A reference reports the release of X.Org Server 26.1.0, identified as xorg-server 26.0.99.901, as a new major update to the display server. It includes the Meson migration, Xwayland integration from the same source tree, protocol and configuration updates, BSD DRM support, rootless log path changes, expanded Xvfb support, and removal of DMX, EXA, and shadow pixmap code.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
opennet.ru
Open sourcephoronix.com
Open sourcelists.x.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
X.Org released security updates for **X.Org Server 21.1.24**, **Xwayland 24.1.13**, and **libXfont2 2.0.8** to address five vulnerabilities tied largely to malformed **PCF fonts** and unsafe graphics context handling. The X server and Xwayland fixes cover **CVE-2026-55999**, a heap buffer overflow in glamor font atlas handling that an authenticated X client can trigger with a crafted PCF font on glamor-backed servers, and **CVE-2026-56000**, a use-after-free in `CommonMakeCurrent()` involving GLX `contextTags` that can be reached through malicious GLX context creation and `MakeCurrent` requests. The libXfont2 update fixes **CVE-2026-56001**, an integer-overflow-driven heap buffer overflow in `BitmapScaleBitmaps()`; **CVE-2026-56002**, a heap buffer overflow in `pcfReadFont()` during PCF parsing; and **CVE-2026-56003**, a heap buffer overflow in `ComputeScaledProperties()` caused by an unchecked fixed-size property buffer. X.Org said the flaws were reported anonymously through Trend Micro's **Zero Day Initiative**, and downstream reporting warned the bugs could enable privilege escalation or potentially remote code execution where the X server runs as root or where X11 forwarding is exposed over SSH.
Jul 12, 2026
X.Org disclosed **nine security vulnerabilities** in the X server and Xwayland and released fixes in **`xorg-server 21.1.23`** and **`xwayland 24.1.12`**. The bugs, later assigned **`CVE-2026-50256`** through **`CVE-2026-50264`**, affect versions prior to those releases and span multiple subsystems including **libXfont2/font alias handling, XSYNC, XKB, GLX, screensaver code, and DRI2**. Reported impacts include crashes, information disclosure, memory corruption, and possible **privilege escalation** where the X server runs as root; some reports also note potential **remote code execution** exposure in environments using **SSH X11 forwarding**. Most issues were reported by an anonymous researcher working with TrendAI Zero Day Initiative, while one DRI2 flaw was credited to Peter Hutterer of Red Hat. The fixes address several distinct bug classes: a **stack-based buffer overflow** caused by a font-name length mismatch during alias resolution, multiple **use-after-free** conditions in XSYNC object teardown and `CreateSaverWindow`, stricter GLX request-size validation to stop malformed client requests from reaching unsafe paths, and DRI2 hardening to validate and deduplicate buffer attachments before allocation and processing. One disclosed flaw, tracked as **`CVE-2026-50256`**, allows any client able to connect to the server to trigger a font-alias overflow that could lead to denial of service or elevated impact on root-run servers. Red Hat separately rated affected X.Org server packages as **Important** across supported RHEL releases, underscoring the need to update exposed X.Org and Xwayland deployments.
Jun 29, 2026
X.Org released **libXfont2 2.0.9** to fix two memory-corruption flaws in the font-server client: **CVE-2026-59679**, an out-of-bounds heap read/write caused by inconsistent character and extent counts in font-server replies, and **CVE-2026-44950**, a heap-buffer overflow in `fs_read_glyphs()` caused by cumulative glyph bitmap writes exceeding the allocated buffer. A malicious font server can exploit either vulnerability to crash an unprivileged X server or potentially gain elevated privileges where the X server runs as root; both issues are incomplete fixes for **CVE-2014-0210**. Red Hat has issued Important security updates for affected RHEL 10 and RHEL 9 SAP-related Update Services and lifecycle channels. Fixed packages include **libXfont2 2.0.6-5.el10_2.3** for RHEL 10, **2.0.3-12.el9_4.3** for RHEL 9.4 channels, and **2.0.3-12.el9_2.3** for RHEL 9.2 channels, covering supported x86_64, aarch64, ppc64le, s390x, and, where applicable, i686 systems. Organizations should apply the relevant vendor updates, particularly on systems operating X servers with root privileges.
Sep 1, 2026