X.Org X Server & Wayland Heap Overflow/UAF Vulnerabilities Advisory

Vulnerability Overview Multiple security issues exist in the X.Org X server and Wayland, which were found in their respective implementations. These issues arise because several security fixes published by X.Org were not fully resolved. Impact Scope X.Org X server: Versions prior to 21.1.24 Wayland: Versions prior to 24.1.13 Resolution X.Org X server: Version 21.1.24 Wayland: Version 24.1.13 Vulnerability Details 1. CVE-2026-55999: glamor Font Atlas Heap Buffer Overflow Description: The function copies each per-glyph bitmap from the font's declared when calculating each glyph, using the metrics of individual glyphs (via the / macros). There is no check to verify whether actually contains per-glyph values. Exploitation: When loading fonts from a malicious PCF file, the per-glyph metrics exceed the font's . This results in a per-glyph memory overflow that far exceeds the heap-allocated slots, causing a heap buffer overflow that an attacker can control. Trigger Conditions: Add a directory containing a malicious PCF font via , then draw text using the glamor backend. Affected Servers: Servers using the glamor acceleration backend (Xorg with Mesa drivers). 2. CVE-2026-56000: GLX contextTags Use-After-Free in Description: In the GLX dispatch layer, the function captures pointers from the per-client array before calling . This leads to a use-after-free vulnerability. Exploitation: A malicious client can trigger the use-after-free by creating 16 GLX contexts and then releasing them, causing to point to the old buffer. Trigger Conditions: Requires 14 X11 requests (17 CreateContext + 17 MakeCurrent). Patched Code CVE-2026-55999 CVE-2026-56000 Additional Information Discoverer: Anonymous working with Trend Micro Zero Day Initiative ZDI Number: ZDI-CAN-30498, ZDI-CAN-30561 Attachments Signature Attachment: signature.asc (196 bytes) Related Links Open Source Software Security Wiki: Link Mailing List Guide: Link --- The above is a summary of key vulnerability information from the webpage screenshot.

Goal Reached Thanks to every supporter — we hit 100%!

X.Org X Server & Wayland Heap Overflow/UAF Vulnerabilities Advisory