CVE-2026-55999: 
NixOS vulnerability analysis and mitigation

CVE-2026-55999 is a heap buffer overflow vulnerability in the glamor font atlas handling of X.Org X server and Xwayland, dubbed "glamor Font Atlas Heap Buffer Overflow." It affects xorg-server before version 21.1.24 and xwayland before version 24.1.13. The flaw was disclosed on July 8, 2026, via an X.Org Security Advisory and the oss-security mailing list. It carries a CVSS v3.1 base score of 7.8 (High) per NVD, though ENISA/GitHub Advisory rates it 8.5 (High) under a different scoring vector (Openwall Advisory, GitHub Advisory, Red Hat Bugzilla).

The root cause (CWE-122: Heap-based Buffer Overflow; CWE-805: Buffer Access with Incorrect Length Value) lies in glamor_font_get(), which builds a per-font texture atlas using slot dimensions derived from the font's declared maxbounds, but copies each per-glyph bitmap using the individual glyph's actual metrics (GLYPHHEIGHTPIXELS/GLYPHWIDTHBYTES macros) without verifying that maxbounds actually bounds the per-glyph values. An authenticated local X client can exploit this by using SetFontPath to add a directory containing a crafted PCF font file whose per-glyph metrics exceed the declared maxbounds, then loading the font via OpenFont and drawing text on a glamor-backed drawable — causing memcpy to write far beyond the heap-allocated slot with attacker-controlled extent and content. Only servers using the glamor acceleration backend (Xorg with modesetting driver, Xwayland) are affected; traditional software-rendered X servers are not. The fix is available at the upstream commit (Openwall Advisory, Red Hat Bugzilla, Upstream Fix).

Successful exploitation allows a local attacker with an X connection to achieve arbitrary code execution with the privileges of the X server process, which typically runs with elevated system privileges. The heap overflow is attacker-controlled in both extent and content, enabling high-confidence exploitation for confidentiality, integrity, and availability impacts — including potential privilege escalation on the affected host. The scope is limited to systems running the glamor-accelerated backend (e.g., Xorg with modesetting driver or Xwayland), but these configurations are common in modern Linux desktop environments (Openwall Advisory, Red Hat Bugzilla).

1. Reconnaissance: Identify a target system running xorg-server before 21.1.24 or xwayland before 24.1.13 with the glamor acceleration backend enabled (e.g., Xorg with modesetting driver or Xwayland under a Wayland compositor).
2. Obtain X connection: Authenticate as a local user with access to the X server socket (e.g., via SSH with X forwarding, or a local session).
3. Craft malicious PCF font: Create a PCF font file where per-glyph metrics (GLYPHHEIGHTPIXELS/GLYPHWIDTHBYTES) exceed the font's declared maxbounds field, with the excess data containing a controlled payload.
4. Register malicious font path: Use the X11 SetFontPath request to add a directory containing the crafted PCF font file to the X server's font search path.
5. Load the font: Issue an OpenFont request to load the crafted PCF font into the X server, triggering glamor_font_get() to build the texture atlas.
6. Trigger the overflow: Draw text on a glamor-backed drawable using the loaded font, causing memcpy to write beyond the heap-allocated slot with attacker-controlled data, achieving heap corruption.
7. Achieve code execution: Leverage the heap overflow to overwrite adjacent heap metadata or function pointers, ultimately executing arbitrary code with X server privileges (Openwall Advisory, Red Hat Bugzilla).

• Logs: X server logs (/var/log/Xorg.0.log or journal entries for Xwayland) showing unexpected SetFontPath requests adding non-standard font directories; crash reports or core dumps from the X server process referencing glamor_font_get() or font atlas allocation.
• File System: Presence of unusual or newly created PCF font files (.pcf or .pcf.gz) in non-standard directories; unexpected directories added to the X font path.
• Process: Unusual child processes spawned by the Xorg or Xwayland process; X server process consuming abnormally high memory or crashing with segmentation faults.
• Network: In Xwayland environments, unexpected X11 protocol traffic involving SetFontPath and OpenFont requests from unprivileged clients followed by drawing operations.

Upgrade xorg-server to version 21.1.24 or later, and xwayland to version 24.1.13 or later, which contain the upstream fix (Openwall Advisory, Upstream Fix). Major Linux distributions have released patches: Red Hat Enterprise Linux 8/9/10 via RHSA-2026:38486 through RHSA-2026:38490, SUSE via SUSE-SU-2026:2787-1 and SUSE-SU-2026:2788-1, Fedora, Slackware, AlmaLinux, Rocky Linux, and Amazon Linux 2023 (Red Hat Bugzilla, SUSE Advisory). As a workaround where patching is not immediately possible, restrict X server access to trusted users only and consider disabling the glamor acceleration backend if operationally feasible.

The vulnerability was covered by Phoronix and GamingOnLinux at release time, noting the security fixes in xorg-server 21.1.24 and xwayland 24.1.13 (Phoronix, GamingOnLinux). The Zero Day Initiative published a corresponding advisory (ZDI-26-409), reflecting the coordinated disclosure process. Community response has been routine, with multiple Linux distributions promptly issuing security updates; no significant controversy or unusual social media activity has been observed.