Local attackers with a X connection able to provide PCX fonts to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a heap buffer overflow via SetFont due to missing glyph boundary checks.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade xorg-x11-server-sourceUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-develUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-Xephyr | Jul 13, 2026 | Jul 13, 2026 |
| Alpine Linux | — | Upgrade xorg-serverUpgrade xwayland | Jul 9, 2026 | Jul 8, 2026 |
| Amazon Linux Ami 2 | — | Upgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-develUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-Xnest | Jul 22, 2026 | Jul 22, 2026 |
| Amazon_linux_2023 | — | Upgrade xorg-x11-server-sourceUpgrade xorg-x11-server-Xvfb-debuginfoUpgrade xorg-x11-server-Xwayland-debugsourceUpgrade xorg-x11-server-Xephyr-debuginfoUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-Xnest-debuginfoUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-develUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-Xwayland-debuginfoUpgrade xorg-x11-server-Xwayland-develUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-Xorg-debuginfoUpgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-debugsource | Jul 21, 2026 | Jul 8, 2026 |
| Debian | — | Upgrade xorg-server | Sep 21, 2026 | Jul 8, 2026 |
| Freebsd | — | Upgrade xorg-serverUpgrade xwayland | Jul 9, 2026 | Jul 8, 2026 |
| Gentoo Linux | — | Upgrade x11-base/xorg-server.Upgrade x11-base/xwayland. | Aug 17, 2026 | Aug 17, 2026 |
| Redhat_linux | — | Upgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-Xwayland-debugsourceUpgrade xorg-x11-server-Xephyr-debuginfoUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-Xvfb-debuginfoUpgrade xorg-x11-server-Xdmx-debuginfoUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-develUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-debugsourceUpgrade xorg-x11-server-Xorg-debuginfoUpgrade xorg-x11-server-Xwayland-develUpgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-Xwayland-debuginfoUpgrade xorg-x11-server-Xnest-debuginfo | Jul 14, 2026 | Jul 8, 2026 |
| Rocky_linux | — | Upgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-Xvfb-debuginfoUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-Xwayland-debugsourceUpgrade xorg-x11-server-develUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-Xwayland-develUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-Xwayland-debuginfoUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-Xephyr-debuginfoUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-Xnest-debuginfoUpgrade xorg-x11-server-debugsourceUpgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-Xorg-debuginfoUpgrade xorg-x11-server-Xdmx-debuginfo | Jul 15, 2026 | Jul 14, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub