High ALAS2-2026-3806 1 CVE

Important: xorg-x11-server security update (Amazon Linux 2)

Published Jul 20, 2026 · Updated Jul 20, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-55999: glamor Font Atlas Heap Buffer Overflow

Fixed packages 10

Release	Package	Fixed in
Amazon Linux · 2	xorg-x11-server-common	0:1.20.4-22.amzn2.0.13
Amazon Linux · 2	xorg-x11-server-debuginfo	0:1.20.4-22.amzn2.0.13
Amazon Linux · 2	xorg-x11-server-devel	0:1.20.4-22.amzn2.0.13
Amazon Linux · 2	xorg-x11-server-source	0:1.20.4-22.amzn2.0.13
Amazon Linux · 2	xorg-x11-server-Xdmx	0:1.20.4-22.amzn2.0.13
Amazon Linux · 2	xorg-x11-server-Xephyr	0:1.20.4-22.amzn2.0.13
Amazon Linux · 2	xorg-x11-server-Xnest	0:1.20.4-22.amzn2.0.13
Amazon Linux · 2	xorg-x11-server-Xorg	0:1.20.4-22.amzn2.0.13
Amazon Linux · 2	xorg-x11-server-Xvfb	0:1.20.4-22.amzn2.0.13
Amazon Linux · 2	xorg-x11-server-Xwayland	0:1.20.4-22.amzn2.0.13

Vulnerabilities 1

High 8.5

CVE-2026-55999

xorg-server / xwayland glamor font atlas Heap Buffer Overflow

Local attackers with a X connection able to provide PCX fonts to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a heap buffer overflow via SetFont due to missing glyph boundary checks.

X.Org xwayland xorg-server xorg-server Debian Ubuntu Azure Linux Alpine Wolfi

Jul 8, 2026

References

web
https://alas.aws.amazon.com/cve/html/CVE-2026-55999.html