XWayland 24.1.13

lists.x.org • July 9, 2026

message (by thread): X.Org Security Advisory: multiple security issues X.Org X server and Xwayland message (by thread): [ANNOUNCE] xorg-server 21.1.24 Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] This release contains the fixes for the issues reported in today's security advisory: - CVE-2026-55999: glamor Font Atlas Heap Buffer Overflow - CVE-2026-56000: GLX contextTags Use-After-Free in CommonMakeCurrent() In addition we have a few other smaller cleanup fixes. Mikhail Dmitrichenko (1): xkb: preserve buffer on realloc failure Olivier Fourdan (4): dix: Silence a compiler warning in doListFontsAndAliases() dix: Silent static analyzer warning dix: Silence a compiler warning in doListFontsWithInfo() Xi: Check window attribute is valid in XIChangeCursor Peter Hutterer (7): dix/colormap: fix out-of-bounds read in FindColorInRootCmap glx: fix duplicate tagInfo->vendor = NULL assignment glamor: fix an error path cleanup glx: free old context tag before allocating new one in CommonMakeCurrent fb/mi/glamor: reject glyphs with negative dimensions glamor: reject fonts with per-glyph metrics exceeding maxbounds Bump version to 24.1.13 git tag: xwayland-24.1.13 SHA256: 173aea3d6f79609164c04528e1c8e4c9b60fcd59391c3c9dad4667297d727fb6 xwayland-24.1.13.tar.xz SHA512: e06e58025b441892fdd17ac55fd5c7e137bffc941b76ad784dc008047c778c6ee2895fcc47b9e8c74b1d8372491e69c39933c4186aec4df55571614f8ba98e3c xwayland-24.1.13.tar.xz PGP: -------------- part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 195 bytes Desc: not available URL: message (by thread): X.Org Security Advisory: multiple security issues X.Org X server and Xwayland message (by thread): [ANNOUNCE] xorg-server 21.1.24 Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] More information the xorg mailing list

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

X.Org Server and XWayland Security Vulnerabilities Disclosed On July 8, 2026, X.Org announced security vulnerabilities affecting the X server and XWayland. Two critical CVEs were disclosed: CVE-2026-55999, a heap buffer overflow in glamor Font Atlas, and CVE-2026-56000, a use-after-free vulnerability in GLX contextTags. Both vulnerabilities were patched in the latest releases of X.Org Server (21.1.24) and XWayland (24.1.13). The vulnerabilities could potentially allow attackers to exploit affected systems, but no active exploitation has been reported at this time. Users are advised to update to the latest versions to mitigate risks. The vulnerabilities were confirmed by the X.Org development team and are considered significant due to their potential impact on system integrity. 58

Extracted Entities

XWayland 24.1.13

The full story

Extracted Entities

CVEs (2)

CWE Weaknesses (2)

SHA256 Hashes (1)