High ELSA-2026-38486 1 CVE

Important: xorg-x11-server security update (Oracle Linux 9)

Published Jul 13, 2026 · Updated Jul 13, 2026

Ecosystem: Oracle Linux

Summary

[1.20.11-34.3]
- CVE fix for CVE-2026-55999
Resolves: https://redhat.atlassian.net/browse/RHEL-191493

Fixed packages 8

Release	Package	Fixed in
Oracle Linux · 9	xorg-x11-server-common	0:1.20.11-34.el9_8.3
Oracle Linux · 9	xorg-x11-server-devel	0:1.20.11-34.el9_8.3
Oracle Linux · 9	xorg-x11-server-source	0:1.20.11-34.el9_8.3
Oracle Linux · 9	xorg-x11-server-Xdmx	0:1.20.11-34.el9_8.3
Oracle Linux · 9	xorg-x11-server-Xephyr	0:1.20.11-34.el9_8.3
Oracle Linux · 9	xorg-x11-server-Xnest	0:1.20.11-34.el9_8.3
Oracle Linux · 9	xorg-x11-server-Xorg	0:1.20.11-34.el9_8.3
Oracle Linux · 9	xorg-x11-server-Xvfb	0:1.20.11-34.el9_8.3

Vulnerabilities 1

High 8.5

CVE-2026-55999

xorg-server / xwayland glamor font atlas Heap Buffer Overflow

Local attackers with a X connection able to provide PCX fonts to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a heap buffer overflow via SetFont due to missing glyph boundary checks.

X.Org xwayland xorg-server xorg-server Debian Ubuntu Azure Linux Alpine Wolfi

Jul 8, 2026