Nixpkgs security tracker
Permalink
CVE-2026-55999
8.5 HIGH
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): High (H)
- Privileges Required (PR): Low (L)
- User Interaction (UI): None (N)
- Scope (S): Changed (C)
- Confidentiality (C): High (H)
- Integrity (I): High (H)
- Availability (A): High (H)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): High (H)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): High (H)
- Modified Scope (MS): Changed (C)
- Modified Integrity (MI): High (H)
- Modified Availability (MA): High (H)
by @LeSuisse Activity log
- Created suggestion
-
@LeSuisse
ignored
4 packages
- xwayland
- xwayland-run
- xwayland-satellite
- gnomeExtensions.xwayland-indicator
- @LeSuisse accepted
- @LeSuisse published on GitHub
xorg-server / xwayland glamor font atlas Heap Buffer Overflow
Local attackers with a X connection able to provide PCX fonts to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a heap buffer overflow via SetFont due to missing glyph boundary checks.
References
Affected products
xwayland
- <24.1.13
xorg-server
- <21.1.24
Matching in nixpkgs
pkgs.xorgserver
X server implementation by X.org
Ignored packages (4)
pkgs.xwayland
X server for interfacing X11 apps with the Wayland protocol
pkgs.xwayland-run
Set of small utilities revolving around running Xwayland and various Wayland compositor headless
pkgs.xwayland-satellite
Xwayland outside your Wayland compositor