CVE-2026-93520
X.Org Server XKB ChangeKeycodeRange Heap Out-of-Bounds Write
A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange in X.org X server before 2.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
X.Org Server XKB ChangeKeycodeRange Heap Out-of-Bounds Write
A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange in X.org X server before 2.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.
- Record
CVE-2026-93520- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-122
- Updated
- 2026-11-07
EUVDEUVD-2026-112135
A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange in X.org X server before 2.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.
- Record
EUVD-2026-112135- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-07
GitHub AdvisoriesGHSA-wgf4-w3hh-3mvm
A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ...
A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange in X.org X server before 2.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.
- Record
GHSA-wgf4-w3hh-3mvm- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-122
- Updated
- 2026-11-02
NVD
A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange in X.org X server before 2.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.
- Record
CVE-2026-93520- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-122
- Updated
- 2026-11-06
OSVALPINE-CVE-2026-93520
A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange in X.org X server before 2.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.
- Record
ALPINE-CVE-2026-93520- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSVBELL-CVE-2026-93520
- Record
BELL-CVE-2026-93520- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 36 moreShow less
OSV
X.Org Server XKB ChangeKeycodeRange Heap Out-of-Bounds Write
A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange in X.org X server before 2.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.
- Record
CVE-2026-93520- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-122
- Updated
- 2026-11-07
OSVDEBIAN-CVE-2026-93520
A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange in X.org X server before 2.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.
- Record
DEBIAN-CVE-2026-93520- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-07
OSVOESA-2026-4468
xorg-x11-server security update
X.Org X11 X server
Security Fix(es):
A flaw was found in the X.Org X Server and XWayland. An error handling issue in the X Keyboard Extension (XKB) geometry processing fails to clear a memory pointer after an allocation failure, leading to a double-free condition during cleanup. A local user can exploit this vulnerability by sending a specially crafted request to the display server. This can cause memory corruption, potentially resulting in a Denial of Service (DoS) or arbitrary code execution with elevated privileges. (From Red Hat.)(CVE-2026-88812)
A flaw was found in xorg-x11-server. A use-after-free vulnerability, where the application accesses memory after it has already been released, occurs in the Present extension because window notification entries are not properly unlinked before cleaning up window resources. An authenticated local X client can exploit this flaw by creating cross-window notifications and subsequently destroying the target window. Successful exploitation primarily results in a Denial of Service (DoS) via an X server crash, and may potentially lead to information disclosure.(CVE-2026-93515)
A flaw was found in xorg-x11-server. A local user can exploit a use-after-free condition—where the software attempts to access memory after it has been freed—by establishing a passive input grab and removing an input device. When subsequent input events are processed, the server dereferences the dangling device pointer. This flaw can lead to arbitrary code execution or a Denial of Service (DoS) via an X server crash.(CVE-2026-93516)
A flaw was found in xorg-x11-server. The GLX (OpenGL Extension to the X Window System) interface fails to verify that incoming data sizes do not exceed allocated buffer limits when handling large rendering requests. An authenticated local client can exploit this vulnerability by sending a specially crafted request, triggering a heap-based buffer overflow. Successful exploitation can result in arbitrary code execution with the privileges of the X server or cause a Denial of Service (DoS) by crashing the application. (From Red Hat.)(CVE-2026-93517)
A flaw was found in xorg-x11-server. Due to an integer truncation issue during memory allocation calculations within the X Keyboard Extension (XKB), the server allocates an undersized buffer when resizing key types. An authenticated local client can exploit this vulnerability by sending specially crafted XKB requests, causing a heap-based buffer overflow. This can result in arbitrary code execution or a denial of service (DoS). (From Red Hat.)(CVE-2026-93518)
Input_constrain_cursor() writes barrier events into a fixed-size buffer without checking bounds. When more than 100 pointer barriers are active, the writes overflow the fixed buffer on the stack or heap. An authenticated X client can trigger this by creating more than 100 pointer barriers (using the XFIXES extension) and then generating pointer motion events (e.g. via XTEST). Both extensions are enabled by default.(CVE-2026-93519)
A flaw was found in xorg-x11-server. In the X Keyboard Extension (XKB), key name memory is allocated with an insufficient buffer size compared to the maximum supported range. An authenticated local client can exploit this flaw by sending requests that modify the keycode range, triggering a heap-based buffer overflow. This vulnerability can lead to arbitrary code execution or cause a Denial of Service (DoS) by crashing the X server.(CVE-2026-93520)
A flaw was found in xorg-x11-server. The X server incorrectly calculates buffer sizes and memory offsets when prepending or appending data to RandR (Resize and Rotate extension) provider properties. A local attacker can exploit this vulnerability by sending specially crafted property update requests, causing memory corruption. This flaw could allow an attacker to escalate privileges or cause a denial of service (DoS) by crashing the X server.(CVE-2026-93521)
A flaw was found in xorg-x11-server. A local…
- Record
OESA-2026-4468- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-4469
xorg-x11-server security update
X.Org X11 X server
Security Fix(es):
A flaw was found in the X.Org X Server and XWayland. An error handling issue in the X Keyboard Extension (XKB) geometry processing fails to clear a memory pointer after an allocation failure, leading to a double-free condition during cleanup. A local user can exploit this vulnerability by sending a specially crafted request to the display server. This can cause memory corruption, potentially resulting in a Denial of Service (DoS) or arbitrary code execution with elevated privileges. (From Red Hat.)(CVE-2026-88812)
A flaw was found in xorg-x11-server. A use-after-free vulnerability, where the application accesses memory after it has already been released, occurs in the Present extension because window notification entries are not properly unlinked before cleaning up window resources. An authenticated local X client can exploit this flaw by creating cross-window notifications and subsequently destroying the target window. Successful exploitation primarily results in a Denial of Service (DoS) via an X server crash, and may potentially lead to information disclosure.(CVE-2026-93515)
A flaw was found in xorg-x11-server. A local user can exploit a use-after-free condition—where the software attempts to access memory after it has been freed—by establishing a passive input grab and removing an input device. When subsequent input events are processed, the server dereferences the dangling device pointer. This flaw can lead to arbitrary code execution or a Denial of Service (DoS) via an X server crash.(CVE-2026-93516)
A flaw was found in xorg-x11-server. The GLX (OpenGL Extension to the X Window System) interface fails to verify that incoming data sizes do not exceed allocated buffer limits when handling large rendering requests. An authenticated local client can exploit this vulnerability by sending a specially crafted request, triggering a heap-based buffer overflow. Successful exploitation can result in arbitrary code execution with the privileges of the X server or cause a Denial of Service (DoS) by crashing the application. (From Red Hat.)(CVE-2026-93517)
A flaw was found in xorg-x11-server. Due to an integer truncation issue during memory allocation calculations within the X Keyboard Extension (XKB), the server allocates an undersized buffer when resizing key types. An authenticated local client can exploit this vulnerability by sending specially crafted XKB requests, causing a heap-based buffer overflow. This can result in arbitrary code execution or a denial of service (DoS). (From Red Hat.)(CVE-2026-93518)
Input_constrain_cursor() writes barrier events into a fixed-size buffer without checking bounds. When more than 100 pointer barriers are active, the writes overflow the fixed buffer on the stack or heap. An authenticated X client can trigger this by creating more than 100 pointer barriers (using the XFIXES extension) and then generating pointer motion events (e.g. via XTEST). Both extensions are enabled by default.(CVE-2026-93519)
A flaw was found in xorg-x11-server. In the X Keyboard Extension (XKB), key name memory is allocated with an insufficient buffer size compared to the maximum supported range. An authenticated local client can exploit this flaw by sending requests that modify the keycode range, triggering a heap-based buffer overflow. This vulnerability can lead to arbitrary code execution or cause a Denial of Service (DoS) by crashing the X server.(CVE-2026-93520)
A flaw was found in xorg-x11-server. The X server incorrectly calculates buffer sizes and memory offsets when prepending or appending data to RandR (Resize and Rotate extension) provider properties. A local attacker can exploit this vulnerability by sending specially crafted property update requests, causing memory corruption. This flaw could allow an attacker to escalate privileges or cause a denial of service (DoS) by crashing the X server.(CVE-2026-93521)
A flaw was found in xorg-x11-server. A local…
- Record
OESA-2026-4469- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-4470
xorg-x11-server security update
X.Org X11 X server
Security Fix(es):
A flaw was found in the X.Org X Server and XWayland. An error handling issue in the X Keyboard Extension (XKB) geometry processing fails to clear a memory pointer after an allocation failure, leading to a double-free condition during cleanup. A local user can exploit this vulnerability by sending a specially crafted request to the display server. This can cause memory corruption, potentially resulting in a Denial of Service (DoS) or arbitrary code execution with elevated privileges. (From Red Hat.)(CVE-2026-88812)
A flaw was found in xorg-x11-server. A use-after-free vulnerability, where the application accesses memory after it has already been released, occurs in the Present extension because window notification entries are not properly unlinked before cleaning up window resources. An authenticated local X client can exploit this flaw by creating cross-window notifications and subsequently destroying the target window. Successful exploitation primarily results in a Denial of Service (DoS) via an X server crash, and may potentially lead to information disclosure.(CVE-2026-93515)
A flaw was found in xorg-x11-server. A local user can exploit a use-after-free condition—where the software attempts to access memory after it has been freed—by establishing a passive input grab and removing an input device. When subsequent input events are processed, the server dereferences the dangling device pointer. This flaw can lead to arbitrary code execution or a Denial of Service (DoS) via an X server crash.(CVE-2026-93516)
A flaw was found in xorg-x11-server. The GLX (OpenGL Extension to the X Window System) interface fails to verify that incoming data sizes do not exceed allocated buffer limits when handling large rendering requests. An authenticated local client can exploit this vulnerability by sending a specially crafted request, triggering a heap-based buffer overflow. Successful exploitation can result in arbitrary code execution with the privileges of the X server or cause a Denial of Service (DoS) by crashing the application. (From Red Hat.)(CVE-2026-93517)
A flaw was found in xorg-x11-server. Due to an integer truncation issue during memory allocation calculations within the X Keyboard Extension (XKB), the server allocates an undersized buffer when resizing key types. An authenticated local client can exploit this vulnerability by sending specially crafted XKB requests, causing a heap-based buffer overflow. This can result in arbitrary code execution or a denial of service (DoS). (From Red Hat.)(CVE-2026-93518)
Input_constrain_cursor() writes barrier events into a fixed-size buffer without checking bounds. When more than 100 pointer barriers are active, the writes overflow the fixed buffer on the stack or heap. An authenticated X client can trigger this by creating more than 100 pointer barriers (using the XFIXES extension) and then generating pointer motion events (e.g. via XTEST). Both extensions are enabled by default.(CVE-2026-93519)
A flaw was found in xorg-x11-server. In the X Keyboard Extension (XKB), key name memory is allocated with an insufficient buffer size compared to the maximum supported range. An authenticated local client can exploit this flaw by sending requests that modify the keycode range, triggering a heap-based buffer overflow. This vulnerability can lead to arbitrary code execution or cause a Denial of Service (DoS) by crashing the X server.(CVE-2026-93520)
A flaw was found in xorg-x11-server. The X server incorrectly calculates buffer sizes and memory offsets when prepending or appending data to RandR (Resize and Rotate extension) provider properties. A local attacker can exploit this vulnerability by sending specially crafted property update requests, causing memory corruption. This flaw could allow an attacker to escalate privileges or cause a denial of service (DoS) by crashing the X server.(CVE-2026-93521)
A flaw was found in xorg-x11-server. A local…
- Record
OESA-2026-4470- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-4471
xorg-x11-server security update
X.Org X11 X server
Security Fix(es):
A flaw was found in the X.Org X Server and XWayland. An error handling issue in the X Keyboard Extension (XKB) geometry processing fails to clear a memory pointer after an allocation failure, leading to a double-free condition during cleanup. A local user can exploit this vulnerability by sending a specially crafted request to the display server. This can cause memory corruption, potentially resulting in a Denial of Service (DoS) or arbitrary code execution with elevated privileges. (From Red Hat.)(CVE-2026-88812)
A flaw was found in xorg-x11-server. A use-after-free vulnerability, where the application accesses memory after it has already been released, occurs in the Present extension because window notification entries are not properly unlinked before cleaning up window resources. An authenticated local X client can exploit this flaw by creating cross-window notifications and subsequently destroying the target window. Successful exploitation primarily results in a Denial of Service (DoS) via an X server crash, and may potentially lead to information disclosure.(CVE-2026-93515)
A flaw was found in xorg-x11-server. A local user can exploit a use-after-free condition—where the software attempts to access memory after it has been freed—by establishing a passive input grab and removing an input device. When subsequent input events are processed, the server dereferences the dangling device pointer. This flaw can lead to arbitrary code execution or a Denial of Service (DoS) via an X server crash.(CVE-2026-93516)
A flaw was found in xorg-x11-server. The GLX (OpenGL Extension to the X Window System) interface fails to verify that incoming data sizes do not exceed allocated buffer limits when handling large rendering requests. An authenticated local client can exploit this vulnerability by sending a specially crafted request, triggering a heap-based buffer overflow. Successful exploitation can result in arbitrary code execution with the privileges of the X server or cause a Denial of Service (DoS) by crashing the application. (From Red Hat.)(CVE-2026-93517)
A flaw was found in xorg-x11-server. Due to an integer truncation issue during memory allocation calculations within the X Keyboard Extension (XKB), the server allocates an undersized buffer when resizing key types. An authenticated local client can exploit this vulnerability by sending specially crafted XKB requests, causing a heap-based buffer overflow. This can result in arbitrary code execution or a denial of service (DoS). (From Red Hat.)(CVE-2026-93518)
Input_constrain_cursor() writes barrier events into a fixed-size buffer without checking bounds. When more than 100 pointer barriers are active, the writes overflow the fixed buffer on the stack or heap. An authenticated X client can trigger this by creating more than 100 pointer barriers (using the XFIXES extension) and then generating pointer motion events (e.g. via XTEST). Both extensions are enabled by default.(CVE-2026-93519)
A flaw was found in xorg-x11-server. In the X Keyboard Extension (XKB), key name memory is allocated with an insufficient buffer size compared to the maximum supported range. An authenticated local client can exploit this flaw by sending requests that modify the keycode range, triggering a heap-based buffer overflow. This vulnerability can lead to arbitrary code execution or cause a Denial of Service (DoS) by crashing the X server.(CVE-2026-93520)
A flaw was found in xorg-x11-server. The X server incorrectly calculates buffer sizes and memory offsets when prepending or appending data to RandR (Resize and Rotate extension) provider properties. A local attacker can exploit this vulnerability by sending specially crafted property update requests, causing memory corruption. This flaw could allow an attacker to escalate privileges or cause a denial of service (DoS) by crashing the X server.(CVE-2026-93521)
A flaw was found in xorg-x11-server. A local…
- Record
OESA-2026-4471- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:84574
Red Hat Security Advisory: xorg-x11-server security update
- Record
RHSA-2026:84574- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:85191
Red Hat Security Advisory: xorg-x11-server-Xwayland security update
- Record
RHSA-2026:85191- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:85193
Red Hat Security Advisory: xorg-x11-server-Xwayland security update
- Record
RHSA-2026:85193- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2026:84574
Important: xorg-x11-server security update
X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.
Security Fix(es):
-
xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-93516)
-
xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow (CVE-2026-93517)
-
xorg-x11-server: xorg-x11-server: arbitrary code execution via integer truncation during keyboard mapping resize (CVE-2026-93518)
-
xorg-x11-server: xorg-x11-server: Arbitrary code execution via buffer overflow in input_constrain_cursor() (CVE-2026-93519)
-
xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling (CVE-2026-93520)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:84574- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2026:85191
Important: xorg-x11-server-Xwayland security update
Xwayland is an X server for running X clients under Wayland.
Security Fix(es):
-
xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-93516)
-
xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests (CVE-2026-93521)
-
xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling (CVE-2026-88812)
-
xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice (CVE-2026-93523)
-
xorg-x11-server: glamor: size tmp_bits buffer for source coordinate range in upload_boxes (CVE-2026-93522)
-
xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow (CVE-2026-93517)
-
xorg-x11-server: xorg-x11-server: arbitrary code execution via integer truncation during keyboard mapping resize (CVE-2026-93518)
-
xorg-x11-server: xorg-x11-server: Arbitrary code execution via buffer overflow in input_constrain_cursor() (CVE-2026-93519)
-
xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling (CVE-2026-93520)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:85191- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2026:85193
Important: xorg-x11-server-Xwayland security update
Xwayland is an X server for running X clients under Wayland.
Security Fix(es):
-
xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-93516)
-
xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests (CVE-2026-93521)
-
xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling (CVE-2026-88812)
-
xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice (CVE-2026-93523)
-
xorg-x11-server: glamor: size tmp_bits buffer for source coordinate range in upload_boxes (CVE-2026-93522)
-
xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow (CVE-2026-93517)
-
xorg-x11-server: xorg-x11-server: arbitrary code execution via integer truncation during keyboard mapping resize (CVE-2026-93518)
-
xorg-x11-server: xorg-x11-server: Arbitrary code execution via buffer overflow in input_constrain_cursor() (CVE-2026-93519)
-
xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling (CVE-2026-93520)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:85193- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2026:86907
Important: xorg-x11-server-Xwayland security update
Xwayland is an X server for running X clients under Wayland.
Security Fix(es):
-
xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-93516)
-
xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests (CVE-2026-93521)
-
xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling (CVE-2026-88812)
-
xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice (CVE-2026-93523)
-
xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow (CVE-2026-93517)
-
xorg-x11-server: xorg-x11-server: arbitrary code execution via integer truncation during keyboard mapping resize (CVE-2026-93518)
-
xorg-x11-server: xorg-x11-server: Arbitrary code execution via buffer overflow in input_constrain_cursor() (CVE-2026-93519)
-
xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling (CVE-2026-93520)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:86907- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2026:89747
Important: xorg-x11-server security update
X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.
Security Fix(es):
-
xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-93516)
-
xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests (CVE-2026-93521)
-
xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling (CVE-2026-88812)
-
xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice (CVE-2026-93523)
-
xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow (CVE-2026-93517)
-
xorg-x11-server: xorg-x11-server: arbitrary code execution via integer truncation during keyboard mapping resize (CVE-2026-93518)
-
xorg-x11-server: xorg-x11-server: Arbitrary code execution via buffer overflow in input_constrain_cursor() (CVE-2026-93519)
-
xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling (CVE-2026-93520)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:89747- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2026:95281
Moderate: xorg-x11-server-Xwayland security update
Xwayland is an X server for running X clients under Wayland.
Security Fix(es):
- xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling (CVE-2026-93520)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:95281- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-06
OSVUBUNTU-CVE-2026-93520
A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange in X.org X server before 2.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.
- Record
UBUNTU-CVE-2026-93520- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-05
OSVALSA-2026:84574 No score
Important: xorg-x11-server security update
X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.
Security Fix(es):
- xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-93516)
- xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow (CVE-2026-93517)
- xorg-x11-server: xorg-x11-server: arbitrary code execution via integer truncation during keyboard mapping resize (CVE-2026-93518)
- xorg-x11-server: xorg-x11-server: Arbitrary code execution via buffer overflow in input_constrain_cursor() (CVE-2026-93519)
- xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling (CVE-2026-93520)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:84574- Updated
- 2026-11-02
OSVALSA-2026:85191 No score
Important: xorg-x11-server-Xwayland security update
Xwayland is an X server for running X clients under Wayland.
Security Fix(es):
- xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-93516)
- xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests (CVE-2026-93521)
- xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling (CVE-2026-88812)
- xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice (CVE-2026-93523)
- xorg-x11-server: glamor: size tmp_bits buffer for source coordinate range in upload_boxes (CVE-2026-93522)
- xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow (CVE-2026-93517)
- xorg-x11-server: xorg-x11-server: arbitrary code execution via integer truncation during keyboard mapping resize (CVE-2026-93518)
- xorg-x11-server: xorg-x11-server: Arbitrary code execution via buffer overflow in input_constrain_cursor() (CVE-2026-93519)
- xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling (CVE-2026-93520)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:85191- Updated
- 2026-11-02
OSVALSA-2026:85193 No score
Important: xorg-x11-server-Xwayland security update
Xwayland is an X server for running X clients under Wayland.
Security Fix(es):
- xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-93516)
- xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests (CVE-2026-93521)
- xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling (CVE-2026-88812)
- xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice (CVE-2026-93523)
- xorg-x11-server: glamor: size tmp_bits buffer for source coordinate range in upload_boxes (CVE-2026-93522)
- xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow (CVE-2026-93517)
- xorg-x11-server: xorg-x11-server: arbitrary code execution via integer truncation during keyboard mapping resize (CVE-2026-93518)
- xorg-x11-server: xorg-x11-server: Arbitrary code execution via buffer overflow in input_constrain_cursor() (CVE-2026-93519)
- xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling (CVE-2026-93520)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:85193- Updated
- 2026-11-02
OSVALSA-2026:86907 No score
Important: xorg-x11-server-Xwayland security update
Xwayland is an X server for running X clients under Wayland.
Security Fix(es):
- xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-93516)
- xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests (CVE-2026-93521)
- xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling (CVE-2026-88812)
- xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice (CVE-2026-93523)
- xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow (CVE-2026-93517)
- xorg-x11-server: xorg-x11-server: arbitrary code execution via integer truncation during keyboard mapping resize (CVE-2026-93518)
- xorg-x11-server: xorg-x11-server: Arbitrary code execution via buffer overflow in input_constrain_cursor() (CVE-2026-93519)
- xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling (CVE-2026-93520)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:86907- Updated
- 2026-11-02
OSVALSA-2026:89747 No score
Important: xorg-x11-server security update
X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.
Security Fix(es):
- xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-93516)
- xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests (CVE-2026-93521)
- xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling (CVE-2026-88812)
- xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice (CVE-2026-93523)
- xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow (CVE-2026-93517)
- xorg-x11-server: xorg-x11-server: arbitrary code execution via integer truncation during keyboard mapping resize (CVE-2026-93518)
- xorg-x11-server: xorg-x11-server: Arbitrary code execution via buffer overflow in input_constrain_cursor() (CVE-2026-93519)
- xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling (CVE-2026-93520)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:89747- Updated
- 2026-11-02
OSVALSA-2026:95281 No score
Moderate: xorg-x11-server-Xwayland security update
Xwayland is an X server for running X clients under Wayland.
Security Fix(es):
- xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling (CVE-2026-93520)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:95281- Updated
- 2026-11-04
OSVAZL-111455 No score
CVE-2026-93520 affecting package xorg-x11-server 1.20.10-6
A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange in X.org X server before 2.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.
- Record
AZL-111455- Updated
- 2026-11-05
OSVAZL-111491 No score
CVE-2026-93520 affecting package wayland 1.22.0-1
A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange in X.org X server before 2.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.
- Record
AZL-111491- Updated
- 2026-11-05
OSVAZL-112306 No score
CVE-2026-93520 affecting package xorg-x11-server-Xwayland for versions less than 24.1.14-1
A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange in X.org X server before 2.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.
- Record
AZL-112306- Updated
- 2026-11-02
OSVMGASA-2026-0529 No score
Updated x11-server, x11-server-xwayland, tigervnc packages fixes security vulnerabilities and a regression that crashes the X server with AMD GPUs
XKB SetGeometry TextDoodad Double Free. (CVE-2026-88812) Present Extension Cross-Window Notify Use-After-Free. (CVE-2026-93515) XInput Passive Grab modifierDevice Use-After-Free. (CVE-2026-93516) GLX RenderLarge Heap Buffer Overflow. (CVE-2026-93517) XKB ResizeKeyType Numeric Truncation. (CVE-2026-93518) XFixes Pointer Barrier Event List Buffer Overflow. (CVE-2026-93519) XKB ChangeKeycodeRange Heap Out-of-Bounds Write. (CVE-2026-93520) RandR ChangeProviderProperty Heap Buffer Overflow. (CVE-2026-93521) Glamor CopyArea CPU-FBO Heap Buffer Overflow. (CVE-2026-93522) XInput2 PassiveUngrabDevice Modifier Out-of-Bounds Write. (CVE-2026-93523) XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read. (CVE-2026-93524) GestureBuildSprite Use-After-Free. (CVE-2026-93536)
- Record
MGASA-2026-0529- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12104-1 No score
xorg-x11-server-21.1.24-2.1 on GA media
These are all security issues fixed in the xorg-x11-server-21.1.24-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12104-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12105-1 No score
xwayland-24.1.13-2.1 on GA media
These are all security issues fixed in the xwayland-24.1.13-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12105-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:22085-1 No score
Security update for xwayland
This update for xwayland fixes the following issues:
- CVE-2026-88812: XKB SetGeometry TextDoodad Double Free (bsc#1281213).
- CVE-2026-93515: X.Org Server Present Extension Use-After-Free (bsc#1281218).
- CVE-2026-93516: X.Org Server XInput Passive Grab Use-After-Free (bsc#1281220).
- CVE-2026-93517: GLX RenderLarge Heap Buffer Overflow (bsc#1281225).
- CVE-2026-93518: XKB ResizeKeyType Numeric Truncation (bsc#1281227).
- CVE-2026-93519: XFixes Pointer Barrier Event List Buffer Overflow (bsc#1281233).
- CVE-2026-93520: XKB ChangeKeycodeRange Heap Out-of-Bounds Write (bsc#1281236).
- CVE-2026-93521: RandR ChangeProviderProperty Heap Buffer Overflow (bsc#1281238).
- CVE-2026-93522: Glamor CopyArea Heap Buffer Overflow (bsc#1281240).
- CVE-2026-93523: XInput2 PassiveUngrabDevice Out-of-Bounds Write (bsc#1281241).
- CVE-2026-93524: XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read (bsc#1281242).
- CVE-2026-93536: GestureBuildSprite Use-After-Free (bsc#1281244).
- Record
openSUSE-SU-2026:22085-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:24230-1 No score
Security update for xwayland
This update for xwayland fixes the following issues:
- CVE-2026-88812: XKB SetGeometry TextDoodad Double Free (bsc#1281213).
- CVE-2026-93515: X.Org Server Present Extension Use-After-Free (bsc#1281218).
- CVE-2026-93516: X.Org Server XInput Passive Grab Use-After-Free (bsc#1281220).
- CVE-2026-93517: GLX RenderLarge Heap Buffer Overflow (bsc#1281225).
- CVE-2026-93518: XKB ResizeKeyType Numeric Truncation (bsc#1281227).
- CVE-2026-93519: XFixes Pointer Barrier Event List Buffer Overflow (bsc#1281233).
- CVE-2026-93520: XKB ChangeKeycodeRange Heap Out-of-Bounds Write (bsc#1281236).
- CVE-2026-93521: RandR ChangeProviderProperty Heap Buffer Overflow (bsc#1281238).
- CVE-2026-93522: Glamor CopyArea Heap Buffer Overflow (bsc#1281240).
- CVE-2026-93523: XInput2 PassiveUngrabDevice Out-of-Bounds Write (bsc#1281241).
- CVE-2026-93524: XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read (bsc#1281242).
- CVE-2026-93536: GestureBuildSprite Use-After-Free (bsc#1281244).
- Record
SUSE-SU-2026:24230-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:4636-1 No score
Security update for xorg-x11-server
This update for xorg-x11-server fixes the following issues:
- CVE-2026-88812: XKB SetGeometry TextDoodad Double Free (bsc#1281213).
- CVE-2026-93515: X.Org Server Present Extension Use-After-Free (bsc#1281218).
- CVE-2026-93516: X.Org Server XInput Passive Grab Use-After-Free (bsc#1281220).
- CVE-2026-93517: GLX RenderLarge Heap Buffer Overflow (bsc#1281225).
- CVE-2026-93518: XKB ResizeKeyType Numeric Truncation (bsc#1281227).
- CVE-2026-93519: XFixes Pointer Barrier Event List Buffer Overflow (bsc#1281233).
- CVE-2026-93520: XKB ChangeKeycodeRange Heap Out-of-Bounds Write (bsc#1281236).
- CVE-2026-93521: RandR ChangeProviderProperty Heap Buffer Overflow (bsc#1281238).
- CVE-2026-93523: XInput2 PassiveUngrabDevice Out-of-Bounds Write (bsc#1281241).
- CVE-2026-93524: XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read (bsc#1281242).
- Record
SUSE-SU-2026:4636-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:4645-1 No score
Security update for xorg-x11-server
This update for xorg-x11-server fixes the following issues:
- CVE-2026-88812: XKB SetGeometry TextDoodad Double Free (bsc#1281213).
- CVE-2026-93515: X.Org Server Present Extension Use-After-Free (bsc#1281218).
- CVE-2026-93516: X.Org Server XInput Passive Grab Use-After-Free (bsc#1281220).
- CVE-2026-93517: GLX RenderLarge Heap Buffer Overflow (bsc#1281225).
- CVE-2026-93518: XKB ResizeKeyType Numeric Truncation (bsc#1281227).
- CVE-2026-93519: XFixes Pointer Barrier Event List Buffer Overflow (bsc#1281233).
- CVE-2026-93520: XKB ChangeKeycodeRange Heap Out-of-Bounds Write (bsc#1281236).
- CVE-2026-93521: RandR ChangeProviderProperty Heap Buffer Overflow (bsc#1281238).
- CVE-2026-93523: XInput2 PassiveUngrabDevice Out-of-Bounds Write (bsc#1281241).
- CVE-2026-93524: XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read (bsc#1281242).
- CVE-2026-93536: GestureBuildSprite Use-After-Free (bsc#1281244).
- Record
SUSE-SU-2026:4645-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:4646-1 No score
Security update for xorg-x11-server
This update for xorg-x11-server fixes the following issues:
- CVE-2026-88812: XKB SetGeometry TextDoodad Double Free (bsc#1281213).
- CVE-2026-93515: X.Org Server Present Extension Use-After-Free (bsc#1281218).
- CVE-2026-93516: X.Org Server XInput Passive Grab Use-After-Free (bsc#1281220).
- CVE-2026-93517: GLX RenderLarge Heap Buffer Overflow (bsc#1281225).
- CVE-2026-93518: XKB ResizeKeyType Numeric Truncation (bsc#1281227).
- CVE-2026-93519: XFixes Pointer Barrier Event List Buffer Overflow (bsc#1281233).
- CVE-2026-93520: XKB ChangeKeycodeRange Heap Out-of-Bounds Write (bsc#1281236).
- CVE-2026-93521: RandR ChangeProviderProperty Heap Buffer Overflow (bsc#1281238).
- CVE-2026-93523: XInput2 PassiveUngrabDevice Out-of-Bounds Write (bsc#1281241).
- CVE-2026-93524: XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read (bsc#1281242).
- CVE-2026-93536: GestureBuildSprite Use-After-Free (bsc#1281244).
- Record
SUSE-SU-2026:4646-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:4647-1 No score
Security update for xorg-x11-server
This update for xorg-x11-server fixes the following issues:
- CVE-2026-88812: XKB SetGeometry TextDoodad Double Free (bsc#1281213).
- CVE-2026-93515: X.Org Server Present Extension Use-After-Free (bsc#1281218).
- CVE-2026-93516: X.Org Server XInput Passive Grab Use-After-Free (bsc#1281220).
- CVE-2026-93517: GLX RenderLarge Heap Buffer Overflow (bsc#1281225).
- CVE-2026-93518: XKB ResizeKeyType Numeric Truncation (bsc#1281227).
- CVE-2026-93519: XFixes Pointer Barrier Event List Buffer Overflow (bsc#1281233).
- CVE-2026-93520: XKB ChangeKeycodeRange Heap Out-of-Bounds Write (bsc#1281236).
- CVE-2026-93521: RandR ChangeProviderProperty Heap Buffer Overflow (bsc#1281238).
- CVE-2026-93523: XInput2 PassiveUngrabDevice Out-of-Bounds Write (bsc#1281241).
- CVE-2026-93524: XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read (bsc#1281242).
- CVE-2026-93536: GestureBuildSprite Use-After-Free (bsc#1281244).
- Record
SUSE-SU-2026:4647-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:4663-1 No score
Security update for xorg-x11-server
This update for xorg-x11-server fixes the following issues:
- CVE-2026-88812: XKB SetGeometry TextDoodad Double Free (bsc#1281213).
- CVE-2026-93515: X.Org Server Present Extension Use-After-Free (bsc#1281218).
- CVE-2026-93516: X.Org Server XInput Passive Grab Use-After-Free (bsc#1281220).
- CVE-2026-93517: GLX RenderLarge Heap Buffer Overflow (bsc#1281225).
- CVE-2026-93518: XKB ResizeKeyType Numeric Truncation (bsc#1281227).
- CVE-2026-93519: XFixes Pointer Barrier Event List Buffer Overflow (bsc#1281233).
- CVE-2026-93520: XKB ChangeKeycodeRange Heap Out-of-Bounds Write (bsc#1281236).
- CVE-2026-93521: RandR ChangeProviderProperty Heap Buffer Overflow (bsc#1281238).
- CVE-2026-93523: XInput2 PassiveUngrabDevice Out-of-Bounds Write (bsc#1281241).
- CVE-2026-93524: XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read (bsc#1281242).
- Record
SUSE-SU-2026:4663-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:4835-1 No score
Security update for xwayland
This update for xwayland fixes the following issues:
- CVE-2026-88812: XKB SetGeometry TextDoodad Double Free (bsc#1281213).
- CVE-2026-93515: X.Org Server Present Extension Use-After-Free (bsc#1281218).
- CVE-2026-93516: X.Org Server XInput Passive Grab Use-After-Free (bsc#1281220).
- CVE-2026-93517: GLX RenderLarge Heap Buffer Overflow (bsc#1281225).
- CVE-2026-93518: XKB ResizeKeyType Numeric Truncation (bsc#1281227).
- CVE-2026-93519: XFixes Pointer Barrier Event List Buffer Overflow (bsc#1281233).
- CVE-2026-93520: XKB ChangeKeycodeRange Heap Out-of-Bounds Write (bsc#1281236).
- CVE-2026-93521: RandR ChangeProviderProperty Heap Buffer Overflow (bsc#1281238).
- CVE-2026-93522: Glamor CopyArea Heap Buffer Overflow (bsc#1281240).
- CVE-2026-93523: XInput2 PassiveUngrabDevice Out-of-Bounds Write (bsc#1281241).
- CVE-2026-93524: XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read (bsc#1281242).
- CVE-2026-93536: GestureBuildSprite Use-After-Free (bsc#1281244).
- Record
SUSE-SU-2026:4835-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xorg-serverAlpine:v3.24 |
before 21.1.25-r0 | 21.1.25-r0 |
xwaylandAlpine:v3.24 |
before 24.1.14-r0 | 24.1.14-r0 |
xorg-x11-server-XdmxAlmaLinux:9 From an advisory covering 5 CVEs |
before 1.20.11-34.el9_8.5 | 1.20.11-34.el9_8.5 |
xorg-x11-server-XephyrAlmaLinux:9 From an advisory covering 5 CVEs |
before 1.20.11-34.el9_8.5 | 1.20.11-34.el9_8.5 |
xorg-x11-server-XnestAlmaLinux:9 From an advisory covering 5 CVEs |
before 1.20.11-34.el9_8.5 | 1.20.11-34.el9_8.5 |
xorg-x11-server-XorgAlmaLinux:9 From an advisory covering 5 CVEs |
before 1.20.11-34.el9_8.5 | 1.20.11-34.el9_8.5 |
xorg-x11-server-XvfbAlmaLinux:9 From an advisory covering 5 CVEs |
before 1.20.11-34.el9_8.5 | 1.20.11-34.el9_8.5 |
xorg-x11-server-commonAlmaLinux:9 From an advisory covering 5 CVEs |
before 1.20.11-34.el9_8.5 | 1.20.11-34.el9_8.5 |
xorg-x11-server-develAlmaLinux:9 From an advisory covering 5 CVEs |
before 1.20.11-34.el9_8.5 | 1.20.11-34.el9_8.5 |
xorg-x11-server-sourceAlmaLinux:9 From an advisory covering 5 CVEs |
before 1.20.11-34.el9_8.5 | 1.20.11-34.el9_8.5 |
Show 107 moreShow less
| Package | Affected | Fixed |
|---|---|---|
xorg-x11-server-XwaylandAlmaLinux:10 From an advisory covering 9 CVEs |
before 24.1.9-4.el10_2.4 | 24.1.9-4.el10_2.4 |
xorg-x11-server-Xwayland-develAlmaLinux:10 From an advisory covering 9 CVEs |
before 24.1.9-4.el10_2.4 | 24.1.9-4.el10_2.4 |
xorg-x11-server-XwaylandAlmaLinux:9 From an advisory covering 9 CVEs |
before 24.1.9-4.el9_8.4 | 24.1.9-4.el9_8.4 |
xorg-x11-server-Xwayland-develAlmaLinux:9 From an advisory covering 9 CVEs |
before 24.1.9-4.el9_8.4 | 24.1.9-4.el9_8.4 |
xorg-x11-server-XwaylandAlmaLinux:8 From an advisory covering 8 CVEs |
before 21.1.3-20.el8_10.4 | 21.1.3-20.el8_10.4 |
xorg-x11-server-XdmxAlmaLinux:8 From an advisory covering 8 CVEs |
before 1.20.11-28.el8_10.5 | 1.20.11-28.el8_10.5 |
xorg-x11-server-XephyrAlmaLinux:8 From an advisory covering 8 CVEs |
before 1.20.11-28.el8_10.5 | 1.20.11-28.el8_10.5 |
xorg-x11-server-XnestAlmaLinux:8 From an advisory covering 8 CVEs |
before 1.20.11-28.el8_10.5 | 1.20.11-28.el8_10.5 |
xorg-x11-server-XorgAlmaLinux:8 From an advisory covering 8 CVEs |
before 1.20.11-28.el8_10.5 | 1.20.11-28.el8_10.5 |
xorg-x11-server-XvfbAlmaLinux:8 From an advisory covering 8 CVEs |
before 1.20.11-28.el8_10.5 | 1.20.11-28.el8_10.5 |
xorg-x11-server-commonAlmaLinux:8 From an advisory covering 8 CVEs |
before 1.20.11-28.el8_10.5 | 1.20.11-28.el8_10.5 |
xorg-x11-server-develAlmaLinux:8 From an advisory covering 8 CVEs |
before 1.20.11-28.el8_10.5 | 1.20.11-28.el8_10.5 |
xorg-x11-server-sourceAlmaLinux:8 From an advisory covering 8 CVEs |
before 1.20.11-28.el8_10.5 | 1.20.11-28.el8_10.5 |
xorg-x11-server-XwaylandAlmaLinux:8 |
before 21.1.3-20.el8_10.5 | 21.1.3-20.el8_10.5 |
xorg-x11-serverAzure Linux:3 |
through 1.20.10-6 | None known |
waylandAzure Linux:3 |
through 1.22.0-1 | None known |
xorg-x11-server-XwaylandAzure Linux:3 |
before 24.1.14-1 | 24.1.14-1 |
xorg-serverAlpaquita:23 |
21.1.4-r1 up to 21.1.25-r0 | 21.1.25-r0 |
xorg-serverAlpaquita:25 |
21.1.16-r0 up to 21.1.25-r0 | 21.1.25-r0 |
xorg-serverAlpaquita:stream |
21.1.4-r1 up to 21.1.25-r0 | 21.1.25-r0 |
xorg-serverDebian:12 |
All versions, plus listed versions 2:21.1.10-12:21.1.11-12:21.1.11-22:21.1.11-32:21.1.12-1 Show 39 moreShow less2:21.1.13-12:21.1.13-22:21.1.13-32:21.1.13-3.12:21.1.14-12:21.1.14-22:21.1.15-12:21.1.15-22:21.1.15-32:21.1.16-12:21.1.16-1.12:21.1.16-1.22:21.1.16-1.32:21.1.18-12:21.1.18-22:21.1.20-12:21.1.21-12:21.1.22-12:21.1.23-12:21.1.24-12:21.1.25-12:21.1.25-22:21.1.7-32:21.1.7-3+deb12u12:21.1.7-3+deb12u102:21.1.7-3+deb12u112:21.1.7-3+deb12u122:21.1.7-3+deb12u132:21.1.7-3+deb12u22:21.1.7-3+deb12u32:21.1.7-3+deb12u42:21.1.7-3+deb12u52:21.1.7-3+deb12u62:21.1.7-3+deb12u72:21.1.7-3+deb12u82:21.1.7-3+deb12u92:21.1.8-12:21.1.9-12:21.1.9-1+hurd.1 |
None known |
xorg-serverDebian:13 |
All versions, plus listed versions 2:21.1.16-1.32:21.1.16-1.3+deb13u12:21.1.16-1.3+deb13u22:21.1.16-1.3+deb13u32:21.1.16-1.3+deb13u4 Show 9 moreShow less2:21.1.18-12:21.1.18-22:21.1.20-12:21.1.21-12:21.1.22-12:21.1.23-12:21.1.24-12:21.1.25-12:21.1.25-2 |
None known |
xorg-serverDebian:14 |
before 2:21.1.25-1, plus listed versions 2:21.1.16-1.32:21.1.18-12:21.1.18-22:21.1.20-12:21.1.21-12:21.1.22-12:21.1.23-12:21.1.24-1 |
2:21.1.25-1 |
xwaylandDebian:12 |
All versions, plus listed versions 2:22.1.9-12:23.1.0-12:23.1.1-12:23.2.0-12:23.2.1-1 Show 20 moreShow less2:23.2.2-12:23.2.3-12:23.2.4-12:23.2.6-12:24.0.99.901-12:24.1.0-12:24.1.10-12:24.1.11-12:24.1.12-12:24.1.13-12:24.1.14-12:24.1.2-12:24.1.3-12:24.1.4-12:24.1.4-22:24.1.4-32:24.1.5-12:24.1.6-12:24.1.8-12:24.1.9-1 |
None known |
xwaylandDebian:13 |
All versions, plus listed versions 2:24.1.10-12:24.1.11-12:24.1.12-12:24.1.13-12:24.1.14-12:24.1.6-12:24.1.8-12:24.1.9-1 |
None known |
xwaylandDebian:14 |
before 2:24.1.14-1, plus listed versions 2:24.1.10-12:24.1.11-12:24.1.12-12:24.1.13-12:24.1.6-12:24.1.8-12:24.1.9-1 |
2:24.1.14-1 |
x11-serverMageia:10 From an advisory covering 12 CVEs |
before 21.1.25-2.mga10 | 21.1.25-2.mga10 |
x11-server-xwaylandMageia:10 From an advisory covering 12 CVEs |
before 24.1.14-1.mga10 | 24.1.14-1.mga10 |
tigervncMageia:10 From an advisory covering 12 CVEs |
before 1.15.0-7.3.mga10 | 1.15.0-7.3.mga10 |
xorg-x11-serveropenEuler:22.03-LTS-SP4 From an advisory covering 10 CVEs |
before 1.20.11-48.oe2203sp4 | 1.20.11-48.oe2203sp4 |
xorg-x11-serveropenEuler:24.03-LTS-SP1 From an advisory covering 10 CVEs |
before 1.20.11-49.oe2403sp1 | 1.20.11-49.oe2403sp1 |
xorg-x11-serveropenEuler:24.03-LTS-SP3 From an advisory covering 10 CVEs |
before 1.20.11-49.oe2403sp3 | 1.20.11-49.oe2403sp3 |
xorg-x11-serveropenEuler:24.03-LTS-SP4 From an advisory covering 10 CVEs |
before 1.20.11-49.oe2403sp4 | 1.20.11-49.oe2403sp4 |
xorg-x11-serverRed Hat:enterprise_linux:9::appstream From an advisory covering 5 CVEs |
before 0:1.20.11-34.el9_8.5 | 0:1.20.11-34.el9_8.5 |
xorg-x11-server-XdmxRed Hat:enterprise_linux:9::appstream From an advisory covering 5 CVEs |
before 0:1.20.11-34.el9_8.5 | 0:1.20.11-34.el9_8.5 |
xorg-x11-server-Xdmx-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 5 CVEs |
before 0:1.20.11-34.el9_8.5 | 0:1.20.11-34.el9_8.5 |
xorg-x11-server-XephyrRed Hat:enterprise_linux:9::appstream From an advisory covering 5 CVEs |
before 0:1.20.11-34.el9_8.5 | 0:1.20.11-34.el9_8.5 |
xorg-x11-server-Xephyr-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 5 CVEs |
before 0:1.20.11-34.el9_8.5 | 0:1.20.11-34.el9_8.5 |
xorg-x11-server-XnestRed Hat:enterprise_linux:9::appstream From an advisory covering 5 CVEs |
before 0:1.20.11-34.el9_8.5 | 0:1.20.11-34.el9_8.5 |
xorg-x11-server-Xnest-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 5 CVEs |
before 0:1.20.11-34.el9_8.5 | 0:1.20.11-34.el9_8.5 |
xorg-x11-server-XorgRed Hat:enterprise_linux:9::appstream From an advisory covering 5 CVEs |
before 0:1.20.11-34.el9_8.5 | 0:1.20.11-34.el9_8.5 |
xorg-x11-server-Xorg-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 5 CVEs |
before 0:1.20.11-34.el9_8.5 | 0:1.20.11-34.el9_8.5 |
xorg-x11-server-XvfbRed Hat:enterprise_linux:9::appstream From an advisory covering 5 CVEs |
before 0:1.20.11-34.el9_8.5 | 0:1.20.11-34.el9_8.5 |
xorg-x11-server-Xvfb-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 5 CVEs |
before 0:1.20.11-34.el9_8.5 | 0:1.20.11-34.el9_8.5 |
xorg-x11-server-commonRed Hat:enterprise_linux:9::appstream From an advisory covering 5 CVEs |
before 0:1.20.11-34.el9_8.5 | 0:1.20.11-34.el9_8.5 |
xorg-x11-server-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 5 CVEs |
before 0:1.20.11-34.el9_8.5 | 0:1.20.11-34.el9_8.5 |
xorg-x11-server-debugsourceRed Hat:enterprise_linux:9::appstream From an advisory covering 5 CVEs |
before 0:1.20.11-34.el9_8.5 | 0:1.20.11-34.el9_8.5 |
xorg-x11-server-Xdmx-debuginfoRed Hat:enterprise_linux:9::crb From an advisory covering 5 CVEs |
before 0:1.20.11-34.el9_8.5 | 0:1.20.11-34.el9_8.5 |
xorg-x11-server-Xephyr-debuginfoRed Hat:enterprise_linux:9::crb From an advisory covering 5 CVEs |
before 0:1.20.11-34.el9_8.5 | 0:1.20.11-34.el9_8.5 |
xorg-x11-server-Xnest-debuginfoRed Hat:enterprise_linux:9::crb From an advisory covering 5 CVEs |
before 0:1.20.11-34.el9_8.5 | 0:1.20.11-34.el9_8.5 |
xorg-x11-server-Xorg-debuginfoRed Hat:enterprise_linux:9::crb From an advisory covering 5 CVEs |
before 0:1.20.11-34.el9_8.5 | 0:1.20.11-34.el9_8.5 |
xorg-x11-server-Xvfb-debuginfoRed Hat:enterprise_linux:9::crb From an advisory covering 5 CVEs |
before 0:1.20.11-34.el9_8.5 | 0:1.20.11-34.el9_8.5 |
xorg-x11-server-debuginfoRed Hat:enterprise_linux:9::crb From an advisory covering 5 CVEs |
before 0:1.20.11-34.el9_8.5 | 0:1.20.11-34.el9_8.5 |
xorg-x11-server-debugsourceRed Hat:enterprise_linux:9::crb From an advisory covering 5 CVEs |
before 0:1.20.11-34.el9_8.5 | 0:1.20.11-34.el9_8.5 |
xorg-x11-server-develRed Hat:enterprise_linux:9::crb From an advisory covering 5 CVEs |
before 0:1.20.11-34.el9_8.5 | 0:1.20.11-34.el9_8.5 |
xorg-x11-server-sourceRed Hat:enterprise_linux:9::crb From an advisory covering 5 CVEs |
before 0:1.20.11-34.el9_8.5 | 0:1.20.11-34.el9_8.5 |
xorg-x11-server-XwaylandRed Hat:enterprise_linux:10.2 From an advisory covering 9 CVEs |
before 0:24.1.9-4.el10_2.4 | 0:24.1.9-4.el10_2.4 |
xorg-x11-server-Xwayland-debuginfoRed Hat:enterprise_linux:10.2 From an advisory covering 9 CVEs |
before 0:24.1.9-4.el10_2.4 | 0:24.1.9-4.el10_2.4 |
xorg-x11-server-Xwayland-debugsourceRed Hat:enterprise_linux:10.2 From an advisory covering 9 CVEs |
before 0:24.1.9-4.el10_2.4 | 0:24.1.9-4.el10_2.4 |
xorg-x11-server-Xwayland-develRed Hat:enterprise_linux:10.2 From an advisory covering 9 CVEs |
before 0:24.1.9-4.el10_2.4 | 0:24.1.9-4.el10_2.4 |
xorg-x11-server-XwaylandRed Hat:enterprise_linux:9::appstream From an advisory covering 9 CVEs |
before 0:24.1.9-4.el9_8.4 | 0:24.1.9-4.el9_8.4 |
xorg-x11-server-Xwayland-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 9 CVEs |
before 0:24.1.9-4.el9_8.4 | 0:24.1.9-4.el9_8.4 |
xorg-x11-server-Xwayland-debugsourceRed Hat:enterprise_linux:9::appstream From an advisory covering 9 CVEs |
before 0:24.1.9-4.el9_8.4 | 0:24.1.9-4.el9_8.4 |
xorg-x11-server-XwaylandRed Hat:enterprise_linux:9::crb From an advisory covering 9 CVEs |
before 0:24.1.9-4.el9_8.4 | 0:24.1.9-4.el9_8.4 |
xorg-x11-server-Xwayland-debuginfoRed Hat:enterprise_linux:9::crb From an advisory covering 9 CVEs |
before 0:24.1.9-4.el9_8.4 | 0:24.1.9-4.el9_8.4 |
xorg-x11-server-Xwayland-debugsourceRed Hat:enterprise_linux:9::crb From an advisory covering 9 CVEs |
before 0:24.1.9-4.el9_8.4 | 0:24.1.9-4.el9_8.4 |
xorg-x11-server-Xwayland-develRed Hat:enterprise_linux:9::crb From an advisory covering 9 CVEs |
before 0:24.1.9-4.el9_8.4 | 0:24.1.9-4.el9_8.4 |
xorg-x11-serverRocky Linux:9 From an advisory covering 5 CVEs |
before 0:1.20.11-34.el9_8.5 | 0:1.20.11-34.el9_8.5 |
xorg-x11-server-XwaylandRocky Linux:10 From an advisory covering 9 CVEs |
before 0:24.1.9-4.el10_2.4 | 0:24.1.9-4.el10_2.4 |
xorg-x11-server-XwaylandRocky Linux:9 From an advisory covering 9 CVEs |
before 0:24.1.9-4.el9_8.4 | 0:24.1.9-4.el9_8.4 |
xorg-x11-server-XwaylandRocky Linux:8 From an advisory covering 8 CVEs |
before 0:21.1.3-20.el8_10.4 | 0:21.1.3-20.el8_10.4 |
xorg-x11-serverRocky Linux:8 From an advisory covering 8 CVEs |
before 0:1.20.11-28.el8_10.5 | 0:1.20.11-28.el8_10.5 |
xorg-x11-server-XwaylandRocky Linux:8 |
before 0:21.1.3-20.el8_10.5 | 0:21.1.3-20.el8_10.5 |
xwaylandSUSE:Linux Enterprise Server 16.0 From an advisory covering 12 CVEs |
before 24.1.6-160000.7.1 | 24.1.6-160000.7.1 |
xwaylandSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 12 CVEs |
before 24.1.6-160000.7.1 | 24.1.6-160000.7.1 |
xorg-x11-serverSUSE:Linux Enterprise Server 12 SP5-LTSS From an advisory covering 10 CVEs |
before 1.19.6-10.108.1 | 1.19.6-10.108.1 |
xorg-x11-serverSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 From an advisory covering 10 CVEs |
before 1.19.6-10.108.1 | 1.19.6-10.108.1 |
xorg-x11-serverSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 11 CVEs |
before 21.1.4-150500.7.55.1 | 21.1.4-150500.7.55.1 |
xorg-x11-serverSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 11 CVEs |
before 21.1.4-150500.7.55.1 | 21.1.4-150500.7.55.1 |
xorg-x11-serverSUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 11 CVEs |
before 21.1.4-150500.7.55.1 | 21.1.4-150500.7.55.1 |
xorg-x11-serverSUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 11 CVEs |
before 21.1.4-150500.7.55.1 | 21.1.4-150500.7.55.1 |
xorg-x11-serverSUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 11 CVEs |
before 21.1.15-150700.5.25.1 | 21.1.15-150700.5.25.1 |
xorg-x11-serverSUSE:Linux Enterprise Module for Development Tools 15 SP7 From an advisory covering 11 CVEs |
before 21.1.15-150700.5.25.1 | 21.1.15-150700.5.25.1 |
xorg-x11-serverSUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 11 CVEs |
before 21.1.11-150600.5.34.1 | 21.1.11-150600.5.34.1 |
xorg-x11-serverSUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 11 CVEs |
before 21.1.11-150600.5.34.1 | 21.1.11-150600.5.34.1 |
xorg-x11-serverSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 10 CVEs |
before 1.20.3-150400.38.77.1 | 1.20.3-150400.38.77.1 |
xorg-x11-serverSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 10 CVEs |
before 1.20.3-150400.38.77.1 | 1.20.3-150400.38.77.1 |
xorg-x11-serverSUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 10 CVEs |
before 1.20.3-150400.38.77.1 | 1.20.3-150400.38.77.1 |
xorg-x11-serverSUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 10 CVEs |
before 1.20.3-150400.38.77.1 | 1.20.3-150400.38.77.1 |
xwaylandSUSE:Linux Enterprise Workstation Extension 15 SP7 From an advisory covering 12 CVEs |
before 24.1.5-150700.3.25.1 | 24.1.5-150700.3.25.1 |
xorg-serverUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 2:1.14.3-3ubuntu22:1.14.3-3ubuntu32:1.14.3-3ubuntu42:1.14.3-5ubuntu12:1.14.4-1ubuntu1 Show 30 moreShow less2:1.14.4-1ubuntu22:1.14.4.901-0ubuntu22:1.14.5-1ubuntu22:1.14.5-1ubuntu42:1.15.0-1ubuntu12:1.15.0-1ubuntu22:1.15.0-1ubuntu32:1.15.0-1ubuntu42:1.15.0-1ubuntu62:1.15.0-1ubuntu72:1.15.1-0ubuntu12:1.15.1-0ubuntu22:1.15.1-0ubuntu2.12:1.15.1-0ubuntu2.42:1.15.1-0ubuntu2.52:1.15.1-0ubuntu2.62:1.15.1-0ubuntu2.72:1.15.1-0ubuntu2.92:1.15.1-0ubuntu2.102:1.15.1-0ubuntu2.112:1.15.1-0ubuntu2.11+esm22:1.15.1-0ubuntu2.11+esm32:1.15.1-0ubuntu2.11+esm42:1.15.1-0ubuntu2.11+esm52:1.15.1-0ubuntu2.11+esm62:1.15.1-0ubuntu2.11+esm72:1.15.1-0ubuntu2.11+esm82:1.15.1-0ubuntu2.11+esm92:1.15.1-0ubuntu2.11+esm112:1.15.1-0ubuntu2.11+esm12 |
None known |
xorg-serverUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2:1.17.2-1ubuntu92:1.17.2-1ubuntu102:1.17.3-2ubuntu12:1.17.3-2ubuntu22:1.17.3-2ubuntu3 Show 33 moreShow less2:1.17.3-2ubuntu42:1.18.1-1ubuntu32:1.18.1-1ubuntu42:1.18.3-1ubuntu12:1.18.3-1ubuntu22:1.18.3-1ubuntu2.22:1.18.3-1ubuntu2.32:1.18.4-0ubuntu0.12:1.18.4-0ubuntu0.22:1.18.4-0ubuntu0.32:1.18.4-0ubuntu0.42:1.18.4-0ubuntu0.62:1.18.4-0ubuntu0.72:1.18.4-0ubuntu0.82:1.18.4-0ubuntu0.92:1.18.4-0ubuntu0.102:1.18.4-0ubuntu0.112:1.18.4-0ubuntu0.122:1.18.4-0ubuntu0.12+esm12:1.18.4-0ubuntu0.12+esm22:1.18.4-0ubuntu0.12+esm42:1.18.4-0ubuntu0.12+esm52:1.18.4-0ubuntu0.12+esm62:1.18.4-0ubuntu0.12+esm82:1.18.4-0ubuntu0.12+esm92:1.18.4-0ubuntu0.12+esm102:1.18.4-0ubuntu0.12+esm122:1.18.4-0ubuntu0.12+esm132:1.18.4-0ubuntu0.12+esm142:1.18.4-0ubuntu0.12+esm152:1.18.4-0ubuntu0.12+esm162:1.18.4-0ubuntu0.12+esm172:1.18.4-0ubuntu0.12+esm18 |
None known |
xorg-server-hwe-16.04Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 2:1.18.4-1ubuntu6.1~16.04.12:1.18.4-1ubuntu6.1~16.04.22:1.19.3-1ubuntu1~16.04.22:1.19.3-1ubuntu1~16.04.32:1.19.3-1ubuntu1~16.04.4 Show 17 moreShow less2:1.19.5-0ubuntu2~16.04.12:1.19.6-1ubuntu4~16.04.12:1.19.6-1ubuntu4.1~16.04.12:1.19.6-1ubuntu4.1~16.04.22:1.19.6-1ubuntu4.1~16.04.32:1.19.6-1ubuntu4.1~16.04.42:1.19.6-1ubuntu4.1~16.04.52:1.19.6-1ubuntu4.1~16.04.62:1.19.6-1ubuntu4.1~16.04.6+esm12:1.19.6-1ubuntu4.1~16.04.6+esm32:1.19.6-1ubuntu4.1~16.04.6+esm42:1.19.6-1ubuntu4.1~16.04.6+esm52:1.19.6-1ubuntu4.1~16.04.6+esm62:1.19.6-1ubuntu4.1~16.04.6+esm72:1.19.6-1ubuntu4.1~16.04.6+esm82:1.19.6-1ubuntu4.1~16.04.6+esm92:1.19.6-1ubuntu4.1~16.04.6+esm10 |
None known |
xorg-serverUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2:1.19.5-0ubuntu22:1.19.6-1ubuntu12:1.19.6-1ubuntu22:1.19.6-1ubuntu32:1.19.6-1ubuntu4 Show 26 moreShow less2:1.19.6-1ubuntu4.12:1.19.6-1ubuntu4.22:1.19.6-1ubuntu4.32:1.19.6-1ubuntu4.42:1.19.6-1ubuntu4.52:1.19.6-1ubuntu4.62:1.19.6-1ubuntu4.72:1.19.6-1ubuntu4.82:1.19.6-1ubuntu4.92:1.19.6-1ubuntu4.102:1.19.6-1ubuntu4.112:1.19.6-1ubuntu4.122:1.19.6-1ubuntu4.132:1.19.6-1ubuntu4.142:1.19.6-1ubuntu4.152:1.19.6-1ubuntu4.15+esm12:1.19.6-1ubuntu4.15+esm32:1.19.6-1ubuntu4.15+esm42:1.19.6-1ubuntu4.15+esm52:1.19.6-1ubuntu4.15+esm72:1.19.6-1ubuntu4.15+esm82:1.19.6-1ubuntu4.15+esm92:1.19.6-1ubuntu4.15+esm102:1.19.6-1ubuntu4.15+esm112:1.19.6-1ubuntu4.15+esm122:1.19.6-1ubuntu4.15+esm13 |
None known |
xorg-server-hwe-18.04Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 2:1.20.1-3ubuntu2.1~18.04.12:1.20.4-1ubuntu3~18.04.12:1.20.5+git20191008-0ubuntu1~18.04.12:1.20.8-2ubuntu2.1~18.04.12:1.20.8-2ubuntu2.2~18.04.1 Show 15 moreShow less2:1.20.8-2ubuntu2.2~18.04.22:1.20.8-2ubuntu2.2~18.04.32:1.20.8-2ubuntu2.2~18.04.42:1.20.8-2ubuntu2.2~18.04.52:1.20.8-2ubuntu2.2~18.04.62:1.20.8-2ubuntu2.2~18.04.72:1.20.8-2ubuntu2.2~18.04.82:1.20.8-2ubuntu2.2~18.04.92:1.20.8-2ubuntu2.2~18.04.102:1.20.8-2ubuntu2.2~18.04.112:1.20.8-2ubuntu2.2~18.04.11+esm12:1.20.8-2ubuntu2.2~18.04.11+esm22:1.20.8-2ubuntu2.2~18.04.11+esm32:1.20.8-2ubuntu2.2~18.04.11+esm42:1.20.8-2ubuntu2.2~18.04.11+esm5 |
None known |
xorg-serverUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2:1.20.5+git20191008-0ubuntu12:1.20.6-1ubuntu12:1.20.7-2ubuntu12:1.20.7-2ubuntu22:1.20.8-2ubuntu2 Show 25 moreShow less2:1.20.8-2ubuntu2.12:1.20.8-2ubuntu2.22:1.20.8-2ubuntu2.32:1.20.8-2ubuntu2.42:1.20.8-2ubuntu2.62:1.20.9-2ubuntu1.1~20.04.12:1.20.9-2ubuntu1.2~20.04.12:1.20.9-2ubuntu1.2~20.04.22:1.20.11-1ubuntu1~20.04.22:1.20.13-1ubuntu1~20.04.22:1.20.13-1ubuntu1~20.04.32:1.20.13-1ubuntu1~20.04.42:1.20.13-1ubuntu1~20.04.52:1.20.13-1ubuntu1~20.04.62:1.20.13-1ubuntu1~20.04.82:1.20.13-1ubuntu1~20.04.92:1.20.13-1ubuntu1~20.04.122:1.20.13-1ubuntu1~20.04.142:1.20.13-1ubuntu1~20.04.152:1.20.13-1ubuntu1~20.04.162:1.20.13-1ubuntu1~20.04.172:1.20.13-1ubuntu1~20.04.182:1.20.13-1ubuntu1~20.04.192:1.20.13-1ubuntu1~20.04.202:1.20.13-1ubuntu1~20.04.20+esm1 |
None known |
xorg-serverUbuntu:22.04:LTS |
All versions, plus listed versions 2:1.20.13-1ubuntu12:1.20.13-1ubuntu22:1.20.14-1ubuntu12:21.1.3-2ubuntu22:21.1.3-2ubuntu2.1 Show 21 moreShow less2:21.1.3-2ubuntu2.22:21.1.3-2ubuntu2.32:21.1.3-2ubuntu2.42:21.1.3-2ubuntu2.52:21.1.3-2ubuntu2.62:21.1.3-2ubuntu2.72:21.1.3-2ubuntu2.82:21.1.3-2ubuntu2.92:21.1.4-2ubuntu1.7~22.04.12:21.1.4-2ubuntu1.7~22.04.22:21.1.4-2ubuntu1.7~22.04.52:21.1.4-2ubuntu1.7~22.04.72:21.1.4-2ubuntu1.7~22.04.82:21.1.4-2ubuntu1.7~22.04.92:21.1.4-2ubuntu1.7~22.04.102:21.1.4-2ubuntu1.7~22.04.112:21.1.4-2ubuntu1.7~22.04.122:21.1.4-2ubuntu1.7~22.04.132:21.1.4-2ubuntu1.7~22.04.142:21.1.4-2ubuntu1.7~22.04.152:21.1.4-2ubuntu1.7~22.04.16 |
None known |
xwaylandUbuntu:22.04:LTS |
All versions, plus listed versions 2:21.1.2-0ubuntu12:21.1.3-12:21.1.3-1ubuntu12:21.1.4-12:22.1.0-1 Show 19 moreShow less2:22.1.1-12:22.1.1-1ubuntu0.12:22.1.1-1ubuntu0.22:22.1.1-1ubuntu0.32:22.1.1-1ubuntu0.42:22.1.1-1ubuntu0.52:22.1.1-1ubuntu0.62:22.1.1-1ubuntu0.72:22.1.1-1ubuntu0.92:22.1.1-1ubuntu0.102:22.1.1-1ubuntu0.112:22.1.1-1ubuntu0.122:22.1.1-1ubuntu0.132:22.1.1-1ubuntu0.142:22.1.1-1ubuntu0.152:22.1.1-1ubuntu0.172:22.1.1-1ubuntu0.182:22.1.1-1ubuntu0.192:22.1.1-1ubuntu0.20 |
None known |
xorg-serverUbuntu:24.04:LTS |
All versions, plus listed versions 2:21.1.7-3ubuntu22:21.1.7-3ubuntu2.12:21.1.10-1ubuntu12:21.1.11-2ubuntu12:21.1.12-1ubuntu1 Show 8 moreShow less2:21.1.12-1ubuntu1.12:21.1.12-1ubuntu1.22:21.1.12-1ubuntu1.32:21.1.12-1ubuntu1.42:21.1.12-1ubuntu1.52:21.1.12-1ubuntu1.62:21.1.12-1ubuntu1.82:21.1.12-1ubuntu1.9 |
None known |
xwaylandUbuntu:24.04:LTS |
All versions, plus listed versions 2:23.2.0-12:23.2.0-1ubuntu0.12:23.2.3-12:23.2.4-12:23.2.4-1build1 Show 10 moreShow less2:23.2.4-1build22:23.2.4-1build32:23.2.6-12:23.2.6-1ubuntu0.12:23.2.6-1ubuntu0.22:23.2.6-1ubuntu0.42:23.2.6-1ubuntu0.52:23.2.6-1ubuntu0.62:23.2.6-1ubuntu0.72:23.2.6-1ubuntu0.8 |
None known |
xorg-serverUbuntu:26.10 |
All versions, plus listed versions 2:21.1.22-1ubuntu12:21.1.22-1ubuntu42:21.1.24-1ubuntu1 |
None known |
xwaylandUbuntu:26.10 |
All versions, plus listed versions 2:24.1.10-12:24.1.12-12:24.1.13-12:24.1.14-1 |
None known |
xorg-serverUbuntu:26.04:LTS |
All versions, plus listed versions 2:21.1.18-1ubuntu12:21.1.21-1ubuntu12:21.1.22-1ubuntu12:21.1.22-1ubuntu1.22:21.1.22-1ubuntu1.3 |
None known |
xwaylandUbuntu:26.04:LTS |
All versions, plus listed versions 2:24.1.6-1ubuntu12:24.1.8-12:24.1.9-12:24.1.10-1 |
None known |
xorg-x11-serveropenSUSE:Tumbleweed From an advisory covering 11 CVEs |
before 21.1.24-2.1 | 21.1.24-2.1 |
xwaylandopenSUSE:Tumbleweed From an advisory covering 12 CVEs |
before 24.1.13-2.1 | 24.1.13-2.1 |
xwaylandopenSUSE:Leap 16.0 From an advisory covering 12 CVEs |
before 24.1.6-160000.7.1 | 24.1.6-160000.7.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| affected | ||
| published | OSV | |
| affected, aliases, facts, references | OSV | |
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-93520 is a high vulnerability (CVSS 7.8) in X.org Xwayland, published October 8, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 10th percentile. Fixed in xorg-server 21.1.25-r0.
References
gitlab.freedesktop.org/xorg/xserver/-/commit/b941a473e06f26a407a9adb15759be79f7418e86
nvd.nist.gov/vuln/detail/CVE-2026-93520
github.com/advisories/GHSA-wgf4-w3hh-3mvm
security.alpinelinux.org/vuln/CVE-2026-93520
access.redhat.com/errata/RHSA-2026:84574
Show 111 moreShow less
bugzilla.redhat.com/2545161
errata.almalinux.org/9/ALSA-2026-84574.html
docs.bell-sw.com/security/cves/CVE-2026-93520
security-tracker.debian.org/tracker/CVE-2026-93520
advisories.mageia.org/MGASA-2026-0529.html
bugs.mageia.org/show_bug.cgi?id=36467
openwall.com/lists/oss-security/2026/10/07/23
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-4468
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84574.json
cve.org/CVERecord?id=CVE-2026-93516
errata.rockylinux.org/RLSA-2026:84574
suse.com/support/update/announcement/2026/suse-su-202624230-1
bugzilla.suse.com/1281213
ubuntu.com/security/CVE-2026-93520
lists.x.org/archives/xorg-announce/2026-October/003747.html
Left out here: the rest of 4 source descriptions. The JSON record has them.