High ELSA-2026-38487 1 CVE

Important: xorg-x11-server security update (Oracle Linux 8)

Published Sep 1, 2026 · Updated Sep 1, 2026

Ecosystem: Oracle Linux

Summary

[1.20.11-28.3]
- CVE fix for CVE-2026-55999
Resolves: https://redhat.atlassian.net/browse/RHEL-191504

Fixed packages 8

Release	Package	Fixed in
Oracle Linux · 8	xorg-x11-server-common	0:1.20.11-28.el8_10.3
Oracle Linux · 8	xorg-x11-server-devel	0:1.20.11-28.el8_10.3
Oracle Linux · 8	xorg-x11-server-source	0:1.20.11-28.el8_10.3
Oracle Linux · 8	xorg-x11-server-Xdmx	0:1.20.11-28.el8_10.3
Oracle Linux · 8	xorg-x11-server-Xephyr	0:1.20.11-28.el8_10.3
Oracle Linux · 8	xorg-x11-server-Xnest	0:1.20.11-28.el8_10.3
Oracle Linux · 8	xorg-x11-server-Xorg	0:1.20.11-28.el8_10.3
Oracle Linux · 8	xorg-x11-server-Xvfb	0:1.20.11-28.el8_10.3

Vulnerabilities 1

High 8.5

CVE-2026-55999

xorg-server / xwayland glamor font atlas Heap Buffer Overflow

Local attackers with a X connection able to provide PCX fonts to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a heap buffer overflow via SetFont due to missing glyph boundary checks.

X.Org xwayland xorg-server xorg-server Debian Ubuntu Azure Linux Alpine Wolfi

Jul 8, 2026