Loading vulnerability…
Glamor Font Atlas Heap Buffer Overflow in X.Org Server and Xwayland
CVE-2026-55999 is a heap-based buffer overflow in the glamor acceleration backend of X.Org Server before 21.1.24 and Xwayland before 24.1.13. The glamor_font_get() function sizes font atlas slots using a font's declared maxbounds but copies glyph bitmaps using individual glyph metrics without verifying that they fit those bounds. A crafted PCF font can therefore cause writes beyond the heap-allocated atlas buffer, with attacker-controlled content and extent. Negative glyph dimensions can additionally wrap unsigned loop counts or copy lengths to extremely large values. An authenticated X client able to supply and render a malicious font can trigger memory corruption, potentially crashing the server or executing code with its privileges.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can corrupt X server heap memory and cause a server crash, disrupting graphical sessions. The attacker-controlled overwrite may permit arbitrary code execution in the X server process, compromising confidentiality and integrity within its security context. If the X server runs with elevated privileges, exploitation may enable privilege escalation. Code execution is a potential consequence rather than an established exploitation outcome.
If you can’t patch tonight, do this now.
Until patched, restrict X server connections to trusted clients and prevent untrusted users from supplying server-side fonts or changing the font search path. Where supported, use a non-glamor rendering backend to avoid the vulnerable code path. Avoid running the X server with elevated privileges to reduce the consequences of exploitation; this does not prevent memory corruption or session disruption.
Patch, then assume compromise.
Upgrade to X.Org Server 21.1.24 or later and Xwayland 24.1.13 or later, or install the distribution's security-backported packages. Debian 13 trixie fixes the issue in xorg-server version 2:21.1.16-1.3+deb13u4. The upstream fix rejects fonts whose per-glyph dimensions are negative or exceed the atlas slot dimensions, releases the associated allocations, and falls back to software rendering.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
33 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.