{"id":"CVE-2026-109095","aliases":["BELL-CVE-2026-109095","DEBIAN-CVE-2026-109095","SUSE-SU-2026:5178-1","SUSE-SU-2026:5180-1","openSUSE-SU-2026:12534-1","openSUSE-SU-2026:12535-1"],"status":"published","title":"Security update for xorg-x11-server","description":"This update for xorg-x11-server fixes the following issues:\n\n- CVE-2026-109091: X.Org Server EDID DS_RANGES Out-Of-Bounds Write (bsc#1285086).\n- CVE-2026-109092: X.Org Server XvShmPutImage Shared-Memory Bounds Overflow (bsc#1285087).\n- CVE-2026-109093: X.Org Server XTestFakeInput Valuator Stack Out-Of-Bounds Write (bsc#1285088).\n- CVE-2026-109094: X.Org Server XRes QueryResourceBytes Swap Path Size Overflow (bsc#1285089).\n- CVE-2026-109095: X.Org Server glamor Xv Image Size Integer Overflow (bsc#1285090).\n- CVE-2026-109096: X.Org Server XvPutImage Negative Image Size Length Bypass (bsc#1285091).\n- CVE-2026-109903: X.Org Server XvQueryImageAttributes Negative Size Reply (bsc#1285093).\n- CVE-2026-109904: X.Org Server XRes QueryClientIds Request Size Overflow (bsc#1285094).","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-11-10T17:38:06Z","modified":"2026-11-12T17:23:23Z","fixes":[{"ecosystem":"Alpaquita:stream","package":"xorg-server","fixed_in":["21.1.26-r0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:stream","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"21.1.4-r1"},{"fixed":"21.1.26-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:21.1.10-1","2:21.1.11-1","2:21.1.11-2","2:21.1.11-3","2:21.1.12-1","2:21.1.13-1","2:21.1.13-2","2:21.1.13-3","2:21.1.13-3.1","2:21.1.14-1","2:21.1.14-2","2:21.1.15-1","2:21.1.15-2","2:21.1.15-3","2:21.1.16-1","2:21.1.16-1.1","2:21.1.16-1.2","2:21.1.16-1.3","2:21.1.18-1","2:21.1.18-2","2:21.1.20-1","2:21.1.21-1","2:21.1.22-1","2:21.1.23-1","2:21.1.24-1","2:21.1.25-1","2:21.1.25-2","2:21.1.7-3","2:21.1.7-3+deb12u1","2:21.1.7-3+deb12u10","2:21.1.7-3+deb12u11","2:21.1.7-3+deb12u12","2:21.1.7-3+deb12u13","2:21.1.7-3+deb12u2","2:21.1.7-3+deb12u3","2:21.1.7-3+deb12u4","2:21.1.7-3+deb12u5","2:21.1.7-3+deb12u6","2:21.1.7-3+deb12u7","2:21.1.7-3+deb12u8","2:21.1.7-3+deb12u9","2:21.1.8-1","2:21.1.9-1","2:21.1.9-1+hurd.1"]},{"source":"osv","ecosystem":"Debian:13","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:21.1.16-1.3","2:21.1.16-1.3+deb13u1","2:21.1.16-1.3+deb13u2","2:21.1.16-1.3+deb13u3","2:21.1.16-1.3+deb13u4","2:21.1.18-1","2:21.1.18-2","2:21.1.20-1","2:21.1.21-1","2:21.1.22-1","2:21.1.23-1","2:21.1.24-1","2:21.1.25-1","2:21.1.25-2"]},{"source":"osv","ecosystem":"Debian:14","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:21.1.16-1.3","2:21.1.18-1","2:21.1.18-2","2:21.1.20-1","2:21.1.21-1","2:21.1.22-1","2:21.1.23-1","2:21.1.24-1","2:21.1.25-1","2:21.1.25-2"]},{"source":"osv","ecosystem":"Debian:12","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:22.1.9-1","2:23.1.0-1","2:23.1.1-1","2:23.2.0-1","2:23.2.1-1","2:23.2.2-1","2:23.2.3-1","2:23.2.4-1","2:23.2.6-1","2:24.0.99.901-1","2:24.1.0-1","2:24.1.10-1","2:24.1.11-1","2:24.1.12-1","2:24.1.13-1","2:24.1.14-1","2:24.1.2-1","2:24.1.3-1","2:24.1.4-1","2:24.1.4-2","2:24.1.4-3","2:24.1.5-1","2:24.1.6-1","2:24.1.8-1","2:24.1.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:24.1.10-1","2:24.1.11-1","2:24.1.12-1","2:24.1.13-1","2:24.1.14-1","2:24.1.6-1","2:24.1.8-1","2:24.1.9-1"]},{"source":"osv","ecosystem":"Debian:14","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:24.1.10-1","2:24.1.11-1","2:24.1.12-1","2:24.1.13-1","2:24.1.14-1","2:24.1.6-1","2:24.1.8-1","2:24.1.9-1"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.6-10.117.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.6-10.117.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150400.38.80.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150400.38.80.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150400.38.80.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150400.38.80.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.25-2.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.1.14-2.1"}]}],"bundled":7}],"references":[{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-109095","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-109095","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265178-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1285086","tags":["report"]},{"url":"https://bugzilla.suse.com/1285087","tags":["report"]},{"url":"https://bugzilla.suse.com/1285088","tags":["report"]},{"url":"https://bugzilla.suse.com/1285089","tags":["report"]},{"url":"https://bugzilla.suse.com/1285090","tags":["report"]},{"url":"https://bugzilla.suse.com/1285091","tags":["report"]},{"url":"https://bugzilla.suse.com/1285093","tags":["report"]},{"url":"https://bugzilla.suse.com/1285094","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109094","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109095","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109096","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109904","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265180-1/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"osv":[{"id":"BELL-CVE-2026-109095","status":"published","published":"2026-11-11T15:15:10.176035Z","modified":"2026-11-12T07:15:02.389845222Z","updated_at":"2026-11-12T07:34:31.180625Z"},{"id":"DEBIAN-CVE-2026-109095","status":"published","published":"2026-11-10T22:47:32.295331914Z","modified":"2026-11-10T23:00:06.490382964Z","updated_at":"2026-11-10T23:15:02.146439Z"},{"id":"openSUSE-SU-2026:12534-1","title":"xorg-x11-server-21.1.25-2.1 on GA media","description":"These are all security issues fixed in the xorg-x11-server-21.1.25-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-11-11T00:00:00Z","modified":"2026-11-12T17:23:23.017053068Z","updated_at":"2026-11-12T18:02:05.26944Z"},{"id":"openSUSE-SU-2026:12535-1","title":"xwayland-24.1.14-2.1 on GA media","description":"These are all security issues fixed in the xwayland-24.1.14-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-11-11T00:00:00Z","modified":"2026-11-12T17:23:23.518673473Z","updated_at":"2026-11-12T18:02:05.26944Z"},{"id":"SUSE-SU-2026:5178-1","title":"Security update for xorg-x11-server","description":"This update for xorg-x11-server fixes the following issues:\n\n- CVE-2026-109091: X.Org Server EDID DS_RANGES Out-Of-Bounds Write (bsc#1285086).\n- CVE-2026-109092: X.Org Server XvShmPutImage Shared-Memory Bounds Overflow (bsc#1285087).\n- CVE-2026-109093: X.Org Server XTestFakeInput Valuator Stack Out-Of-Bounds Write (bsc#1285088).\n- CVE-2026-109094: X.Org Server XRes QueryResourceBytes Swap Path Size Overflow (bsc#1285089).\n- CVE-2026-109095: X.Org Server glamor Xv Image Size Integer Overflow (bsc#1285090).\n- CVE-2026-109096: X.Org Server XvPutImage Negative Image Size Length Bypass (bsc#1285091).\n- CVE-2026-109903: X.Org Server XvQueryImageAttributes Negative Size Reply (bsc#1285093).\n- CVE-2026-109904: X.Org Server XRes QueryClientIds Request Size Overflow (bsc#1285094).\n","status":"published","published":"2026-11-10T17:38:06Z","modified":"2026-11-11T13:00:04.93453177Z","updated_at":"2026-11-11T13:08:46.301371Z"},{"id":"SUSE-SU-2026:5180-1","title":"Security update for xorg-x11-server","description":"This update for xorg-x11-server fixes the following issues:\n\n- CVE-2026-109091: X.Org Server EDID DS_RANGES Out-Of-Bounds Write (bsc#1285086).\n- CVE-2026-109092: X.Org Server XvShmPutImage Shared-Memory Bounds Overflow (bsc#1285087).\n- CVE-2026-109093: X.Org Server XTestFakeInput Valuator Stack Out-Of-Bounds Write (bsc#1285088).\n- CVE-2026-109094: X.Org Server XRes QueryResourceBytes Swap Path Size Overflow (bsc#1285089).\n- CVE-2026-109095: X.Org Server glamor Xv Image Size Integer Overflow (bsc#1285090).\n- CVE-2026-109096: X.Org Server XvPutImage Negative Image Size Length Bypass (bsc#1285091).\n- CVE-2026-109903: X.Org Server XvQueryImageAttributes Negative Size Reply (bsc#1285093).\n- CVE-2026-109904: X.Org Server XRes QueryClientIds Request Size Overflow (bsc#1285094).\n","status":"published","published":"2026-11-10T17:38:52Z","modified":"2026-11-11T13:00:05.819418717Z","updated_at":"2026-11-11T13:08:46.301371Z"}]}}