Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 14

Export CSV
CVE-2026-109903

X.Org Server XvQueryImageAttributes Negative Size Reply

A buffer overread caused by casting a negative integer to CARD32 in XvQueryImageAttributes in X.Org X Server before 21.1.26 and xwayland before 24.1.15 could be used to causes crashes by authenticated X clients.

CVSS 3.1 · 7.8 High EPSS n/a KEV · Not listed
Vendors
X.org
Products
Xorg-x11-server Xwayland
CVE-2026-109904

X.Org Server XRes QueryClientIds Request Size Overflow

A buffer overread caused by an integer-overflow in Proc/SProcXResQueryClientIds in X.Org xwayland before 24.1.15 and X Server before 21.1.26 could be used by attackers on authenticated X clients to crash the server or leak out information.

CVSS 4.0 · 6.9 Medium EPSS n/a KEV · Not listed
Vendors
X.org
Products
Xorg-x11-server Xwayland
CVE-2026-93519

X.Org Server XFixes Pointer Barrier Event List Buffer Overflow

A buffer overflow when handling pointer barriers in the XFIXES extension in X.Org X server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
X.org X.orgg
Products
X Server Xorg-x11-server Xwayland
CVE-2026-93521

X.Org Server RandR ChangeProviderProperty Heap Buffer Overflow

A buffer overflow in RandR ChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14 could be used by authenticated X clients to crash or execute code within the X server context.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
X.org
Products
X Server Xorg-x11-server Xwayland
CVE-2026-93523

X.Org Server XInput2 PassiveUngrabDevice Out-of-Bounds Write

A heap buffer overflow caused by a XIPassiveUngrabDevice request with an out-of-range modifier value in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
X.org
Products
X Server Xorg-x11-server Xwayland
CVE-2026-93520

X.Org Server XKB ChangeKeycodeRange Heap Out-of-Bounds Write

A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange in X.org X server before 2.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
X.org
Products
Xorg-server Xorg-x11-server Xwayland
CVE-2026-93536

X.Org Server GestureBuildSprite Use-After-Free

A use after free caused by missing lifecycle management of gesture sprites in GestureBuildSprite() in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash the X server or potentially execute code.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
X.org
Products
X Server Xorg-x11-server Xwayland
CVE-2026-93524

X.Org Server XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read

A buffer overread in CheckKeySyms() in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to leak small amounts of information from X server memory or potentially crash the X server.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
X.org
Products
X Server Xorg-x11-server Xwayland
CVE-2026-93516

.Org Server XInput Passive Grab Use-After-Free

A use-after-free caused by lack of lifecycle management when adding / removing XInput master devices in X.org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X Clients to crash the X server or potentially execute code in X server context.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
X.org
Products
X Server Xorg-x11-server Xwayland
CVE-2026-93515

.Org Server Present Extension Use-After-Free

A use-after-free in present_clear_window_notifies() in the X.org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by malicious X clients to crash or potentially execute code in the X server context.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
X.org
Products
X Server Xorg-x11-server Xwayland
CVE-2026-93522

X.Org Server Glamor CopyArea Heap Buffer Overflow

A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in the X server context.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
X.org
Products
Xorg-x11-server Xwayland
CVE-2026-93518

X.Org Server XKB ResizeKeyType Numeric Truncation

An integer truncation issue in XkbResizeKeyType() that could lead to a heap buffer overflow by authenticated X clients in X.org X server before 21.1.25 and XWayland before 24.1.14 could be exploited for crashes or potential code execution in the X server.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
X.org
Products
Xorg-server Xorg-x11-server Xwayland
CVE-2026-93517

X.Org Server GLX RenderLarge Heap Buffer Overflow

A heap buffer overflow in handling GLX RenderLarge request where dataBytes exceeds cmdlen in X.org X server before 21.1.25 and XWayland before 24.1.14 that could be be triggered by an authenticated X client could cause crashes or code execution in X server context.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
X.org X.orgg
Products
X Server Xwayland Xorg-x11-server
CVE-2026-88812

X.Org Server XKB SetGeometry TextDoodad Double Free

A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a crash or potentially code in the x server context.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
X.org
Products
Xorg-server Xorg-x11-server Xwayland