Local attackers with a X connection able to provide PCX fonts to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a heap buffer overflow via SetFont due to missing glyph boundary checks.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade xorg-x11-server-Xwayland-develUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-develUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-Xdmx | Jul 13, 2026 | Jul 13, 2026 |
| Alpine Linux | — | Upgrade xorg-serverUpgrade xwayland | Jul 9, 2026 | Jul 8, 2026 |
| Amazon Linux Ami 2 | — | Upgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-devel | Jul 22, 2026 | Jul 22, 2026 |
| Amazon_linux_2023 | — | Upgrade xorg-x11-server-XnestUpgrade xorg-x11-server-Xnest-debuginfoUpgrade xorg-x11-server-Xvfb-debuginfoUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-develUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-Xwayland-debugsourceUpgrade xorg-x11-server-Xephyr-debuginfoUpgrade xorg-x11-server-Xwayland-debuginfoUpgrade xorg-x11-server-debugsourceUpgrade xorg-x11-server-Xwayland-develUpgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-Xorg-debuginfoUpgrade xorg-x11-server-Xorg | Jul 21, 2026 | Jul 8, 2026 |
| Debian | — | Upgrade xorg-server | Sep 21, 2026 | Jul 8, 2026 |
| Freebsd | — | Upgrade xorg-serverUpgrade xwayland | Jul 9, 2026 | Jul 8, 2026 |
| Gentoo Linux | — | Upgrade x11-base/xorg-server.Upgrade x11-base/xwayland. | Aug 17, 2026 | Aug 17, 2026 |
| Oracle_linux | — | Upgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-develUpgrade xorg-x11-server-Xwayland-develUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-Xwayland | Oct 22, 2026 | Jul 8, 2026 |
| Redhat_linux | — | Upgrade xorg-x11-server-Xwayland-develUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-Xnest-debuginfoUpgrade xorg-x11-server-Xwayland-debuginfoUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-debugsourceUpgrade xorg-x11-server-Xorg-debuginfoUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-Xwayland-debugsourceUpgrade xorg-x11-server-Xephyr-debuginfoUpgrade xorg-x11-server-develUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-Xdmx-debuginfoUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-Xvfb-debuginfo | Jul 14, 2026 | Jul 8, 2026 |
| Rocky_linux | — | Upgrade xorg-x11-server-XnestUpgrade xorg-x11-server-Xwayland-debugsourceUpgrade xorg-x11-server-Xwayland-develUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-Xvfb-debuginfoUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-Xwayland-debuginfoUpgrade xorg-x11-server-Xephyr-debuginfoUpgrade xorg-x11-server-develUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-debugsourceUpgrade xorg-x11-server-Xdmx-debuginfoUpgrade xorg-x11-server-Xnest-debuginfoUpgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-Xorg-debuginfo | Jul 15, 2026 | Jul 14, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub