Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-08T00:00:00 xorg: X11: xserver: X.org: glamor Font Atlas Heap Buffer Overflow 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CWE-805

Local attackers with a X connection able to provide PCX fonts to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a heap buffer overflow via SetFont due to missing glyph boundary checks.

A flaw was found in the glamor_font_get() function of the xorg-x11-server. This vulnerability, a heap buffer overflow, occurs when the server processes a specially crafted PCF font file where individual glyph metrics exceed the declared maximum bounds. An authenticated X client can exploit this by loading a malicious font and drawing text, potentially leading to arbitrary code execution with attacker-controlled content and extent. This affects servers utilizing the glamor acceleration backend, such as Xorg with the modesetting driver and Xwayland.

This Important flaw in xorg-x11-server allows an authenticated X client to achieve arbitrary code execution. By processing a malicious PCF font file where glyph metrics exceed declared bounds, a heap buffer overflow occurs within the glamor acceleration backend. This vulnerability primarily impacts Red Hat systems running Xorg with the modesetting driver or Xwayland, typically found in desktop environments. Red Hat Enterprise Linux 10 2026-07-13T00:00:00Z RHSA-2026:38489 xorg-x11-server-Xwayland-0:24.1.9-4.el10_2.3 Red Hat Enterprise Linux 10.0 Extended Update Support 2026-08-04T00:00:00Z RHSA-2026:50100 xorg-x11-server-Xwayland-0:24.1.5-6.el10_0.2 Red Hat Enterprise Linux 7 Extended Lifecycle Support 2026-08-04T00:00:00Z RHSA-2026:50117 xorg-x11-server-0:1.20.4-36.el7_9 Red Hat Enterprise Linux 8 2026-07-13T00:00:00Z RHSA-2026:38487 xorg-x11-server-0:1.20.11-28.el8_10.3 Red Hat Enterprise Linux 8 2026-07-13T00:00:00Z RHSA-2026:38488 xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.3 Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 2026-08-03T00:00:00Z RHSA-2026:49606 xorg-x11-server-0:1.20.10-5.el8_4.1 Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 2026-08-03T00:00:00Z RHSA-2026:49606 xorg-x11-server-0:1.20.10-5.el8_4.1 Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 2026-08-03T00:00:00Z RHSA-2026:49605 xorg-x11-server-0:1.20.11-8.el8_6.1 Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 2026-08-03T00:00:00Z RHSA-2026:49605 xorg-x11-server-0:1.20.11-8.el8_6.1 Red Hat Enterprise Linux 8.8 Telecommunications Update Service 2026-08-04T00:00:00Z RHSA-2026:50116 xorg-x11-server-0:1.20.11-19.el8_8.1 Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 2026-08-04T00:00:00Z RHSA-2026:50116 xorg-x11-server-0:1.20.11-19.el8_8.1 Red Hat Enterprise Linux 9 2026-07-13T00:00:00Z RHSA-2026:38486 xorg-x11-server-0:1.20.11-34.el9_8.3 Red Hat Enterprise Linux 9 2026-07-13T00:00:00Z RHSA-2026:38490 xorg-x11-server-Xwayland-0:24.1.9-4.el9_8.3 Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 2026-08-03T00:00:00Z RHSA-2026:49515 xorg-x11-server-0:1.20.11-21.el9_2.1 Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 2026-08-03T00:00:00Z RHSA-2026:49516 xorg-x11-server-0:1.20.11-29.el9_4.1 Red Hat Enterprise Linux 9.6 Extended Update Support 2026-08-03T00:00:00Z RHSA-2026:49608 xorg-x11-server-0:1.20.11-34.el9_6.1 Red Hat Enterprise Linux 9.6 Extended Update Support 2026-08-05T00:00:00Z RHSA-2026:50718 xorg-x11-server-Xwayland-0:23.2.7-6.el9_6.3 Red Hat Enterprise Linux 6 Not affected xorg-x11-server https://www.cve.org/CVERecord?id=CVE-2026-55999 https://nvd.nist.gov/vuln/detail/CVE-2026-55999