CVE-2026-55999 is a heap-based buffer overflow vulnerability (CWE-122) in the X.Org xorg-server and xwayland components. Local attackers who have an X connection and can provide PCX fonts to the server can trigger this overflow via the SetFont operation because the server lacks proper glyph boundary checks. This vulnerability affects xorg-server versions prior to 21.2.24 and xwayland versions prior to 24.1.13. The CVSS 3.1 base score is 8.5, indicating high severity with network attack vector, high privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. No official patch or remediation level is currently confirmed from the vendor advisory or patch links.

Successful exploitation allows local attackers with an X connection to cause a heap buffer overflow, which can lead to arbitrary code execution or denial of service. The vulnerability impacts confidentiality, integrity, and availability of the affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to the X server to trusted users only and avoid accepting untrusted PCX fonts via SetFont. Monitor vendor channels for updates and apply patches promptly once released.