CVE-2026-109903

X.Org Server XvQueryImageAttributes Negative Size Reply

A buffer overread caused by casting a negative integer to CARD32 in XvQueryImageAttributes in X.Org X Server before 21.1.26 and xwayland before 24.1.15 could be used to causes crashes by authenticated X clients.

CVSS 3.1 · 7.8 High EPSS n/a KEV · Not listed

Vendors

X.org

Products

Xorg-x11-server Xwayland

CVE-2026-109904

X.Org Server XRes QueryClientIds Request Size Overflow

A buffer overread caused by an integer-overflow in Proc/SProcXResQueryClientIds in X.Org xwayland before 24.1.15 and X Server before 21.1.26 could be used by attackers on authenticated X clients to crash the server or leak out information.

CVSS 4.0 · 6.9 Medium EPSS n/a KEV · Not listed

Vendors

X.org

Products

Xorg-x11-server Xwayland

CVE-2026-93519

X.Org Server XFixes Pointer Barrier Event List Buffer Overflow

A buffer overflow when handling pointer barriers in the XFIXES extension in X.Org X server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

X.org X.orgg

Products

X Server Xorg-x11-server Xwayland

CVE-2026-93521

X.Org Server RandR ChangeProviderProperty Heap Buffer Overflow

A buffer overflow in RandR ChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14 could be used by authenticated X clients to crash or execute code within the X server context.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

X.org

Products

X Server Xorg-x11-server Xwayland

CVE-2026-93523

X.Org Server XInput2 PassiveUngrabDevice Out-of-Bounds Write

A heap buffer overflow caused by a XIPassiveUngrabDevice request with an out-of-range modifier value in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

X.org

Products

X Server Xorg-x11-server Xwayland

CVE-2026-93520

X.Org Server XKB ChangeKeycodeRange Heap Out-of-Bounds Write

A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange in X.org X server before 2.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

X.org

Products

Xorg-server Xorg-x11-server Xwayland

CVE-2026-93536

X.Org Server GestureBuildSprite Use-After-Free

A use after free caused by missing lifecycle management of gesture sprites in GestureBuildSprite() in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash the X server or potentially execute code.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

X.org

Products

X Server Xorg-x11-server Xwayland

CVE-2026-93524

X.Org Server XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read

A buffer overread in CheckKeySyms() in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to leak small amounts of information from X server memory or potentially crash the X server.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

X.org

Products

X Server Xorg-x11-server Xwayland

CVE-2026-93516

.Org Server XInput Passive Grab Use-After-Free

A use-after-free caused by lack of lifecycle management when adding / removing XInput master devices in X.org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X Clients to crash the X server or potentially execute code in X server context.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

X.org

Products

X Server Xorg-x11-server Xwayland

CVE-2026-93515

.Org Server Present Extension Use-After-Free

A use-after-free in present_clear_window_notifies() in the X.org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by malicious X clients to crash or potentially execute code in the X server context.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

X.org

Products

X Server Xorg-x11-server Xwayland

CVE-2026-50263

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free information disclosure in createsaverwindow()

A use-after-free flaw was found in the X.Org X server and Xwayland in CreateSaverWindow(). A client can trigger a use-after-free read after changing window attributes and forcing the screen saver, leading to information disclosure.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat X.org

Products

Enterprise Linux Enterprise Linux Eus Rhel Aus and 7 more

CVE-2026-50262

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: out-of-bounds read/write in glx changedrawableattributes

An out-of-bounds read flaw was found in the X.Org X server and Xwayland in __glXDisp_ChangeDrawableAttributes(). A wrong size validation check can read a client-controlled number of bytes, exceeding the request buffer, leading to information disclosure. A write path also exists but requires byte-swapped clients which is disabled by default.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat X.org

Products

Enterprise Linux Enterprise Linux Eus Rhel Aus and 8 more

CVE-2026-93522

X.Org Server Glamor CopyArea Heap Buffer Overflow

A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in the X server context.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

X.org

Products

Xorg-x11-server Xwayland

CVE-2026-93518

X.Org Server XKB ResizeKeyType Numeric Truncation

An integer truncation issue in XkbResizeKeyType() that could lead to a heap buffer overflow by authenticated X clients in X.org X server before 21.1.25 and XWayland before 24.1.14 could be exploited for crashes or potential code execution in the X server.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

X.org

Products

Xorg-server Xorg-x11-server Xwayland

CVE-2026-93517

X.Org Server GLX RenderLarge Heap Buffer Overflow

A heap buffer overflow in handling GLX RenderLarge request where dataBytes exceeds cmdlen in X.org X server before 21.1.25 and XWayland before 24.1.14 that could be be triggered by an authenticated X client could cause crashes or code execution in X server context.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

X.org X.orgg

Products

X Server Xwayland Xorg-x11-server

CVE-2025-62231

Xorg: xmayland: value overflow in xkbsetcompatmap()

A flaw was identified in the X.Org X server’s X Keyboard (Xkb) extension where improper bounds checking in the XkbSetCompatMap() function can cause an unsigned short overflow. If an attacker sends specially crafted input data, the value calculation may overflow, leading to memory corruption or a crash.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Debian Ibm Redhat and 1 more

Products

Debian Linux Aix Vios and 14 more

CVE-2025-62230

Xorg: xwayland: use-after-free in xkb client resource removal

A flaw was discovered in the X.Org X server’s X Keyboard (Xkb) extension when handling client resource cleanup. The software frees certain data structures without properly detaching related resources, leading to a use-after-free condition. This can cause memory corruption or a crash when affected clients disconnect.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Debian Ibm Redhat and 1 more

Products

Debian Linux Aix Vios and 14 more

CVE-2023-5380

Xorg-x11-server: use-after-free bug in destroywindow

A use-after-free flaw was found in the xorg-x11-server. An X server crash may occur in a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode) if the pointer is warped from within a window on one screen to the root window of the other screen and if the original window is destroyed followed by another window being destroyed.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Redhat and 1 more

Products

Debian Linux Fedora Enterprise Linux and 3 more

CVE-2026-50264

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: out-of-bounds heap write in dri2 drigetbuffers/drigetbufferswithformat

An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat. A client that requests multiple DRI2BufferBackLeft attachments and one DRI2BufferFrontLeft can trigger an out-of-bounds heap write. This may be used to crash the server, or for privilege escalation if the X server runs as root.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat X.org

Products

Enterprise Linux Enterprise Linux Eus Rhel Aus and 8 more

CVE-2026-50261

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in syncchangecounter()

A use-after-free flaw was found in the X.Org X server and Xwayland in SyncChangeCounter(). A client that sets up multiple SyncCounters can trigger a use-after-free when destroying those counters via a second client connection while changing those counters. This may be used to crash the server, or for privilege escalation if the X server runs as root.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat X.org

Products

Enterprise Linux Enterprise Linux Eus Rhel Aus and 8 more