{"id":"CVE-2026-93522","aliases":["ALPINE-CVE-2026-93522","ALSA-2026:85191","ALSA-2026:85193","AZL-111461","AZL-112297","BELL-CVE-2026-93522","CLSA-2026-1792791669","DEBIAN-CVE-2026-93522","EUVD-2026-112254","GHSA-5h3m-pr22-58xf","MGASA-2026-0529","RHSA-2026:85191","RHSA-2026:85193","RLSA-2026:85191","RLSA-2026:85193","SUSE-SU-2026:24230-1","SUSE-SU-2026:4835-1","UBUNTU-CVE-2026-93522","openSUSE-SU-2026:12105-1","openSUSE-SU-2026:22085-1"],"status":"published","title":"X.Org Server Glamor CopyArea Heap Buffer Overflow","description":"A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in the X server context.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00202,"percentile":0.10224,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122"],"published":"2026-10-08T17:21:32.694833Z","modified":"2026-11-05T19:17:28Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"xorg-server","fixed_in":["21.1.25-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"xwayland","fixed_in":["24.1.14-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"xorg-x11-server-Xwayland","fixed_in":["24.1.14-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"xorg-server","fixed_in":["21.1.25-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"xorg-server","fixed_in":["21.1.25-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"xorg-server","fixed_in":["21.1.25-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xwayland","fixed_in":["2:24.1.14-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.25-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.1.14-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"xorg-x11-server-Xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.1.9-4.el10_2.4"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"xorg-x11-server-Xwayland-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.1.9-4.el10_2.4"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:9","package":"xorg-x11-server-Xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.1.9-4.el9_8.4"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:9","package":"xorg-x11-server-Xwayland-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.1.9-4.el9_8.4"}]}],"bundled":9},{"source":"osv","ecosystem":"Azure Linux:3","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.20.10-6"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"xorg-x11-server-Xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.1.14-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"21.1.4-r1"},{"fixed":"21.1.25-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"21.1.16-r0"},{"fixed":"21.1.25-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"21.1.4-r1"},{"fixed":"21.1.25-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"xorg-x11-server-Xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.2.7-5.el9_6.tuxcare.els5"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"xorg-x11-server-Xwayland-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.2.7-5.el9_6.tuxcare.els5"}]}],"bundled":8},{"source":"osv","ecosystem":"Debian:12","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:22.1.9-1","2:23.1.0-1","2:23.1.1-1","2:23.2.0-1","2:23.2.1-1","2:23.2.2-1","2:23.2.3-1","2:23.2.4-1","2:23.2.6-1","2:24.0.99.901-1","2:24.1.0-1","2:24.1.10-1","2:24.1.11-1","2:24.1.12-1","2:24.1.13-1","2:24.1.14-1","2:24.1.2-1","2:24.1.3-1","2:24.1.4-1","2:24.1.4-2","2:24.1.4-3","2:24.1.5-1","2:24.1.6-1","2:24.1.8-1","2:24.1.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:24.1.10-1","2:24.1.11-1","2:24.1.12-1","2:24.1.13-1","2:24.1.14-1","2:24.1.6-1","2:24.1.8-1","2:24.1.9-1"]},{"source":"osv","ecosystem":"Debian:14","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:24.1.14-1"}]}],"versions":["2:24.1.10-1","2:24.1.11-1","2:24.1.12-1","2:24.1.13-1","2:24.1.6-1","2:24.1.8-1","2:24.1.9-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.25-2.mga10"}]}],"bundled":12},{"source":"osv","ecosystem":"Mageia:10","package":"x11-server-xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.1.14-1.mga10"}]}],"bundled":12},{"source":"osv","ecosystem":"Mageia:10","package":"tigervnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.0-7.3.mga10"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"xorg-x11-server-Xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.1.9-4.el10_2.4"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"xorg-x11-server-Xwayland-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.1.9-4.el10_2.4"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"xorg-x11-server-Xwayland-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.1.9-4.el10_2.4"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"xorg-x11-server-Xwayland-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.1.9-4.el10_2.4"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"xorg-x11-server-Xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.1.9-4.el9_8.4"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"xorg-x11-server-Xwayland-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.1.9-4.el9_8.4"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"xorg-x11-server-Xwayland-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.1.9-4.el9_8.4"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"xorg-x11-server-Xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.1.9-4.el9_8.4"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"xorg-x11-server-Xwayland-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.1.9-4.el9_8.4"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"xorg-x11-server-Xwayland-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.1.9-4.el9_8.4"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"xorg-x11-server-Xwayland-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.1.9-4.el9_8.4"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:10","package":"xorg-x11-server-Xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.1.9-4.el10_2.4"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:9","package":"xorg-x11-server-Xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.1.9-4.el9_8.4"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.1.6-160000.7.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.1.6-160000.7.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.1.5-150700.3.25.1"}]}],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.14.3-3ubuntu2","2:1.14.3-3ubuntu3","2:1.14.3-3ubuntu4","2:1.14.3-5ubuntu1","2:1.14.4-1ubuntu1","2:1.14.4-1ubuntu2","2:1.14.4.901-0ubuntu2","2:1.14.5-1ubuntu2","2:1.14.5-1ubuntu4","2:1.15.0-1ubuntu1","2:1.15.0-1ubuntu2","2:1.15.0-1ubuntu3","2:1.15.0-1ubuntu4","2:1.15.0-1ubuntu6","2:1.15.0-1ubuntu7","2:1.15.1-0ubuntu1","2:1.15.1-0ubuntu2","2:1.15.1-0ubuntu2.1","2:1.15.1-0ubuntu2.4","2:1.15.1-0ubuntu2.5","2:1.15.1-0ubuntu2.6","2:1.15.1-0ubuntu2.7","2:1.15.1-0ubuntu2.9","2:1.15.1-0ubuntu2.10","2:1.15.1-0ubuntu2.11","2:1.15.1-0ubuntu2.11+esm2","2:1.15.1-0ubuntu2.11+esm3","2:1.15.1-0ubuntu2.11+esm4","2:1.15.1-0ubuntu2.11+esm5","2:1.15.1-0ubuntu2.11+esm6","2:1.15.1-0ubuntu2.11+esm7","2:1.15.1-0ubuntu2.11+esm8","2:1.15.1-0ubuntu2.11+esm9","2:1.15.1-0ubuntu2.11+esm11","2:1.15.1-0ubuntu2.11+esm12"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.17.2-1ubuntu9","2:1.17.2-1ubuntu10","2:1.17.3-2ubuntu1","2:1.17.3-2ubuntu2","2:1.17.3-2ubuntu3","2:1.17.3-2ubuntu4","2:1.18.1-1ubuntu3","2:1.18.1-1ubuntu4","2:1.18.3-1ubuntu1","2:1.18.3-1ubuntu2","2:1.18.3-1ubuntu2.2","2:1.18.3-1ubuntu2.3","2:1.18.4-0ubuntu0.1","2:1.18.4-0ubuntu0.2","2:1.18.4-0ubuntu0.3","2:1.18.4-0ubuntu0.4","2:1.18.4-0ubuntu0.6","2:1.18.4-0ubuntu0.7","2:1.18.4-0ubuntu0.8","2:1.18.4-0ubuntu0.9","2:1.18.4-0ubuntu0.10","2:1.18.4-0ubuntu0.11","2:1.18.4-0ubuntu0.12","2:1.18.4-0ubuntu0.12+esm1","2:1.18.4-0ubuntu0.12+esm2","2:1.18.4-0ubuntu0.12+esm4","2:1.18.4-0ubuntu0.12+esm5","2:1.18.4-0ubuntu0.12+esm6","2:1.18.4-0ubuntu0.12+esm8","2:1.18.4-0ubuntu0.12+esm9","2:1.18.4-0ubuntu0.12+esm10","2:1.18.4-0ubuntu0.12+esm12","2:1.18.4-0ubuntu0.12+esm13","2:1.18.4-0ubuntu0.12+esm14","2:1.18.4-0ubuntu0.12+esm15","2:1.18.4-0ubuntu0.12+esm16","2:1.18.4-0ubuntu0.12+esm17","2:1.18.4-0ubuntu0.12+esm18"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"xorg-server-hwe-16.04","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.18.4-1ubuntu6.1~16.04.1","2:1.18.4-1ubuntu6.1~16.04.2","2:1.19.3-1ubuntu1~16.04.2","2:1.19.3-1ubuntu1~16.04.3","2:1.19.3-1ubuntu1~16.04.4","2:1.19.5-0ubuntu2~16.04.1","2:1.19.6-1ubuntu4~16.04.1","2:1.19.6-1ubuntu4.1~16.04.1","2:1.19.6-1ubuntu4.1~16.04.2","2:1.19.6-1ubuntu4.1~16.04.3","2:1.19.6-1ubuntu4.1~16.04.4","2:1.19.6-1ubuntu4.1~16.04.5","2:1.19.6-1ubuntu4.1~16.04.6","2:1.19.6-1ubuntu4.1~16.04.6+esm1","2:1.19.6-1ubuntu4.1~16.04.6+esm3","2:1.19.6-1ubuntu4.1~16.04.6+esm4","2:1.19.6-1ubuntu4.1~16.04.6+esm5","2:1.19.6-1ubuntu4.1~16.04.6+esm6","2:1.19.6-1ubuntu4.1~16.04.6+esm7","2:1.19.6-1ubuntu4.1~16.04.6+esm8","2:1.19.6-1ubuntu4.1~16.04.6+esm9","2:1.19.6-1ubuntu4.1~16.04.6+esm10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.19.5-0ubuntu2","2:1.19.6-1ubuntu1","2:1.19.6-1ubuntu2","2:1.19.6-1ubuntu3","2:1.19.6-1ubuntu4","2:1.19.6-1ubuntu4.1","2:1.19.6-1ubuntu4.2","2:1.19.6-1ubuntu4.3","2:1.19.6-1ubuntu4.4","2:1.19.6-1ubuntu4.5","2:1.19.6-1ubuntu4.6","2:1.19.6-1ubuntu4.7","2:1.19.6-1ubuntu4.8","2:1.19.6-1ubuntu4.9","2:1.19.6-1ubuntu4.10","2:1.19.6-1ubuntu4.11","2:1.19.6-1ubuntu4.12","2:1.19.6-1ubuntu4.13","2:1.19.6-1ubuntu4.14","2:1.19.6-1ubuntu4.15","2:1.19.6-1ubuntu4.15+esm1","2:1.19.6-1ubuntu4.15+esm3","2:1.19.6-1ubuntu4.15+esm4","2:1.19.6-1ubuntu4.15+esm5","2:1.19.6-1ubuntu4.15+esm7","2:1.19.6-1ubuntu4.15+esm8","2:1.19.6-1ubuntu4.15+esm9","2:1.19.6-1ubuntu4.15+esm10","2:1.19.6-1ubuntu4.15+esm11","2:1.19.6-1ubuntu4.15+esm12","2:1.19.6-1ubuntu4.15+esm13"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"xorg-server-hwe-18.04","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.20.1-3ubuntu2.1~18.04.1","2:1.20.4-1ubuntu3~18.04.1","2:1.20.5+git20191008-0ubuntu1~18.04.1","2:1.20.8-2ubuntu2.1~18.04.1","2:1.20.8-2ubuntu2.2~18.04.1","2:1.20.8-2ubuntu2.2~18.04.2","2:1.20.8-2ubuntu2.2~18.04.3","2:1.20.8-2ubuntu2.2~18.04.4","2:1.20.8-2ubuntu2.2~18.04.5","2:1.20.8-2ubuntu2.2~18.04.6","2:1.20.8-2ubuntu2.2~18.04.7","2:1.20.8-2ubuntu2.2~18.04.8","2:1.20.8-2ubuntu2.2~18.04.9","2:1.20.8-2ubuntu2.2~18.04.10","2:1.20.8-2ubuntu2.2~18.04.11","2:1.20.8-2ubuntu2.2~18.04.11+esm1","2:1.20.8-2ubuntu2.2~18.04.11+esm2","2:1.20.8-2ubuntu2.2~18.04.11+esm3","2:1.20.8-2ubuntu2.2~18.04.11+esm4","2:1.20.8-2ubuntu2.2~18.04.11+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.20.5+git20191008-0ubuntu1","2:1.20.6-1ubuntu1","2:1.20.7-2ubuntu1","2:1.20.7-2ubuntu2","2:1.20.8-2ubuntu2","2:1.20.8-2ubuntu2.1","2:1.20.8-2ubuntu2.2","2:1.20.8-2ubuntu2.3","2:1.20.8-2ubuntu2.4","2:1.20.8-2ubuntu2.6","2:1.20.9-2ubuntu1.1~20.04.1","2:1.20.9-2ubuntu1.2~20.04.1","2:1.20.9-2ubuntu1.2~20.04.2","2:1.20.11-1ubuntu1~20.04.2","2:1.20.13-1ubuntu1~20.04.2","2:1.20.13-1ubuntu1~20.04.3","2:1.20.13-1ubuntu1~20.04.4","2:1.20.13-1ubuntu1~20.04.5","2:1.20.13-1ubuntu1~20.04.6","2:1.20.13-1ubuntu1~20.04.8","2:1.20.13-1ubuntu1~20.04.9","2:1.20.13-1ubuntu1~20.04.12","2:1.20.13-1ubuntu1~20.04.14","2:1.20.13-1ubuntu1~20.04.15","2:1.20.13-1ubuntu1~20.04.16","2:1.20.13-1ubuntu1~20.04.17","2:1.20.13-1ubuntu1~20.04.18","2:1.20.13-1ubuntu1~20.04.19","2:1.20.13-1ubuntu1~20.04.20","2:1.20.13-1ubuntu1~20.04.20+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.20.13-1ubuntu1","2:1.20.13-1ubuntu2","2:1.20.14-1ubuntu1","2:21.1.3-2ubuntu2","2:21.1.3-2ubuntu2.1","2:21.1.3-2ubuntu2.2","2:21.1.3-2ubuntu2.3","2:21.1.3-2ubuntu2.4","2:21.1.3-2ubuntu2.5","2:21.1.3-2ubuntu2.6","2:21.1.3-2ubuntu2.7","2:21.1.3-2ubuntu2.8","2:21.1.3-2ubuntu2.9","2:21.1.4-2ubuntu1.7~22.04.1","2:21.1.4-2ubuntu1.7~22.04.2","2:21.1.4-2ubuntu1.7~22.04.5","2:21.1.4-2ubuntu1.7~22.04.7","2:21.1.4-2ubuntu1.7~22.04.8","2:21.1.4-2ubuntu1.7~22.04.9","2:21.1.4-2ubuntu1.7~22.04.10","2:21.1.4-2ubuntu1.7~22.04.11","2:21.1.4-2ubuntu1.7~22.04.12","2:21.1.4-2ubuntu1.7~22.04.13","2:21.1.4-2ubuntu1.7~22.04.14","2:21.1.4-2ubuntu1.7~22.04.15","2:21.1.4-2ubuntu1.7~22.04.16"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:21.1.2-0ubuntu1","2:21.1.3-1","2:21.1.3-1ubuntu1","2:21.1.4-1","2:22.1.0-1","2:22.1.1-1","2:22.1.1-1ubuntu0.1","2:22.1.1-1ubuntu0.2","2:22.1.1-1ubuntu0.3","2:22.1.1-1ubuntu0.4","2:22.1.1-1ubuntu0.5","2:22.1.1-1ubuntu0.6","2:22.1.1-1ubuntu0.7","2:22.1.1-1ubuntu0.9","2:22.1.1-1ubuntu0.10","2:22.1.1-1ubuntu0.11","2:22.1.1-1ubuntu0.12","2:22.1.1-1ubuntu0.13","2:22.1.1-1ubuntu0.14","2:22.1.1-1ubuntu0.15","2:22.1.1-1ubuntu0.17","2:22.1.1-1ubuntu0.18","2:22.1.1-1ubuntu0.19","2:22.1.1-1ubuntu0.20"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:21.1.7-3ubuntu2","2:21.1.7-3ubuntu2.1","2:21.1.10-1ubuntu1","2:21.1.11-2ubuntu1","2:21.1.12-1ubuntu1","2:21.1.12-1ubuntu1.1","2:21.1.12-1ubuntu1.2","2:21.1.12-1ubuntu1.3","2:21.1.12-1ubuntu1.4","2:21.1.12-1ubuntu1.5","2:21.1.12-1ubuntu1.6","2:21.1.12-1ubuntu1.8","2:21.1.12-1ubuntu1.9"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:23.2.0-1","2:23.2.0-1ubuntu0.1","2:23.2.3-1","2:23.2.4-1","2:23.2.4-1build1","2:23.2.4-1build2","2:23.2.4-1build3","2:23.2.6-1","2:23.2.6-1ubuntu0.1","2:23.2.6-1ubuntu0.2","2:23.2.6-1ubuntu0.4","2:23.2.6-1ubuntu0.5","2:23.2.6-1ubuntu0.6","2:23.2.6-1ubuntu0.7","2:23.2.6-1ubuntu0.8"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:21.1.22-1ubuntu1","2:21.1.22-1ubuntu4","2:21.1.24-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:24.1.10-1","2:24.1.12-1","2:24.1.13-1","2:24.1.14-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:21.1.18-1ubuntu1","2:21.1.21-1ubuntu1","2:21.1.22-1ubuntu1","2:21.1.22-1ubuntu1.2","2:21.1.22-1ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:24.1.6-1ubuntu1","2:24.1.8-1","2:24.1.9-1","2:24.1.10-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.1.13-2.1"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.1.6-160000.7.1"}]}],"bundled":12}],"products":[{"vendor":"the xorg project","product":"xorg-x11-server"},{"vendor":"x.org","product":"xorg-x11-server"},{"vendor":"x.org","product":"xwayland"}],"references":[{"url":"https://gitlab.freedesktop.org/xorg/xserver/-/commit/ad26c26bf795e6464f74c8ef5bb1d41403d877ab","tags":["patch","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93522","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-5h3m-pr22-58xf"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-93522","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:85191","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-88812","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-93516","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-93517","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-93518","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-93519","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-93520","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-93521","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-93522","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-93523","tags":["report"]},{"url":"https://bugzilla.redhat.com/2545161","tags":["report"]},{"url":"https://bugzilla.redhat.com/2545164","tags":["report"]},{"url":"https://bugzilla.redhat.com/2545174","tags":["report"]},{"url":"https://bugzilla.redhat.com/2545177","tags":["report"]},{"url":"https://bugzilla.redhat.com/2545178","tags":["report"]},{"url":"https://bugzilla.redhat.com/2545246","tags":["report"]},{"url":"https://bugzilla.redhat.com/2545860","tags":["report"]},{"url":"https://bugzilla.redhat.com/2545887","tags":["report"]},{"url":"https://bugzilla.redhat.com/2545908","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-85191.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:85193","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-85193.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-93522","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1792791669.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88812","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93516","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93517","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93518","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93519","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93521","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93523","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93522.json","tags":["advisory"]},{"url":"https://gitlab.freedesktop.org/xorg/xserver","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-93522","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0529.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36467","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/07/23","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36488","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2545161","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2545164","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2545174","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2545177","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2545178","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2545246","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2545860","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2545887","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2545908","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_85191.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-88812","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93516","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93517","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93518","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93519","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93520","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93520","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93521","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93522","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93523","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_85193.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:85191","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:85193","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624230-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1281213","tags":["report"]},{"url":"https://bugzilla.suse.com/1281218","tags":["report"]},{"url":"https://bugzilla.suse.com/1281220","tags":["report"]},{"url":"https://bugzilla.suse.com/1281225","tags":["report"]},{"url":"https://bugzilla.suse.com/1281227","tags":["report"]},{"url":"https://bugzilla.suse.com/1281233","tags":["report"]},{"url":"https://bugzilla.suse.com/1281236","tags":["report"]},{"url":"https://bugzilla.suse.com/1281238","tags":["report"]},{"url":"https://bugzilla.suse.com/1281240","tags":["report"]},{"url":"https://bugzilla.suse.com/1281241","tags":["report"]},{"url":"https://bugzilla.suse.com/1281242","tags":["report"]},{"url":"https://bugzilla.suse.com/1281244","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93515","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93516","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93519","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93520","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93521","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93522","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93536","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264835-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-93522","tags":["report"]},{"url":"https://lists.x.org/archives/xorg-announce/2026-October/003747.html","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-93522","title":"X.Org Server Glamor CopyArea Heap Buffer Overflow","description":"A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in the X server context.","status":"published","published":"2026-10-28T16:03:56.072Z","modified":"2026-11-05T18:54:01.703Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-122"],"updated_at":"2026-11-05T19:54:51.398642Z"}],"euvd":[{"id":"EUVD-2026-112254","description":"A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in the X server context.","status":"published","published":"2026-10-28T16:03:56Z","modified":"2026-11-05T18:54:01Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T20:01:48.85376Z"}],"ghsa":[{"id":"GHSA-5h3m-pr22-58xf","title":"A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO path in X.Org X...","description":"A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in the X server context.","status":"published","published":"2026-10-28T18:32:02Z","modified":"2026-10-28T18:32:10Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:14:35.861264Z"}],"nvd":[{"id":"CVE-2026-93522","description":"A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in the X server context.","status":"published","published":"2026-10-28T16:17:10.183Z","modified":"2026-11-05T19:17:28.317Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-122"],"updated_at":"2026-11-05T21:56:47.444894Z"}],"osv":[{"id":"ALPINE-CVE-2026-93522","description":"A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in the X server context.","status":"published","published":"2026-10-28T16:17:10.183Z","modified":"2026-11-03T06:33:04.743139569Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:15:37.282377Z"},{"id":"BELL-CVE-2026-93522","status":"published","published":"2026-10-08T17:21:32.694833Z","modified":"2026-10-30T07:15:09.654115942Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:27.164451Z"},{"id":"CVE-2026-93522","title":"X.Org Server Glamor CopyArea Heap Buffer Overflow","description":"A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in the X server context.","status":"published","published":"2026-10-28T16:03:56.072Z","modified":"2026-11-07T07:06:42.168440143Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-122"],"updated_at":"2026-11-07T03:08:12.44191Z"},{"id":"DEBIAN-CVE-2026-93522","description":"A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in the X server context.","status":"published","published":"2026-10-28T16:17:10.183Z","modified":"2026-10-30T09:49:24.781089295Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:06.846102Z"},{"id":"RHSA-2026:85191","title":"Red Hat Security Advisory: xorg-x11-server-Xwayland security update","status":"published","published":"2026-10-20T10:17:59Z","modified":"2026-10-20T10:31:43.071644273Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:85193","title":"Red Hat Security Advisory: xorg-x11-server-Xwayland security update","status":"published","published":"2026-10-20T10:17:59Z","modified":"2026-10-20T10:31:43.06822711Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:85191","title":"Important: xorg-x11-server-Xwayland security update","description":"Xwayland is an X server for running X clients under Wayland.\n\nSecurity Fix(es):\n\n* xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-93516)\n\n* xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests (CVE-2026-93521)\n\n* xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling (CVE-2026-88812)\n\n* xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice (CVE-2026-93523)\n\n* xorg-x11-server: glamor: size tmp_bits buffer for source coordinate  range in upload_boxes (CVE-2026-93522)\n\n* xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow (CVE-2026-93517)\n\n* xorg-x11-server: xorg-x11-server: arbitrary code execution via integer truncation during keyboard mapping resize (CVE-2026-93518)\n\n* xorg-x11-server: xorg-x11-server: Arbitrary code execution via buffer overflow in input_constrain_cursor() (CVE-2026-93519)\n\n* xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling (CVE-2026-93520)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-20T12:10:14.939262Z","modified":"2026-10-20T12:15:37.991033197Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:85193","title":"Important: xorg-x11-server-Xwayland security update","description":"Xwayland is an X server for running X clients under Wayland.\n\nSecurity Fix(es):\n\n* xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-93516)\n\n* xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests (CVE-2026-93521)\n\n* xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling (CVE-2026-88812)\n\n* xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice (CVE-2026-93523)\n\n* xorg-x11-server: glamor: size tmp_bits buffer for source coordinate  range in upload_boxes (CVE-2026-93522)\n\n* xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow (CVE-2026-93517)\n\n* xorg-x11-server: xorg-x11-server: arbitrary code execution via integer truncation during keyboard mapping resize (CVE-2026-93518)\n\n* xorg-x11-server: xorg-x11-server: Arbitrary code execution via buffer overflow in input_constrain_cursor() (CVE-2026-93519)\n\n* xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling (CVE-2026-93520)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-20T12:05:07.452289Z","modified":"2026-10-20T12:15:38.495025733Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"UBUNTU-CVE-2026-93522","description":"A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in the X server context.","status":"published","published":"2026-10-28T16:17:00Z","modified":"2026-11-05T11:47:34.972485831Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"ALSA-2026:85191","title":"Important: xorg-x11-server-Xwayland security update","description":"Xwayland is an X server for running X clients under Wayland.  \n\nSecurity Fix(es):  \n\n  * xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-93516)\n  * xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests (CVE-2026-93521)\n  * xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling (CVE-2026-88812)\n  * xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice (CVE-2026-93523)\n  * xorg-x11-server: glamor: size tmp_bits buffer for source coordinate range in upload_boxes (CVE-2026-93522)\n  * xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow (CVE-2026-93517)\n  * xorg-x11-server: xorg-x11-server: arbitrary code execution via integer truncation during keyboard mapping resize (CVE-2026-93518)\n  * xorg-x11-server: xorg-x11-server: Arbitrary code execution via buffer overflow in input_constrain_cursor() (CVE-2026-93519)\n  * xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling (CVE-2026-93520)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-19T00:00:00Z","modified":"2026-10-29T11:31:02.271233922Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:85193","title":"Important: xorg-x11-server-Xwayland security update","description":"Xwayland is an X server for running X clients under Wayland.  \n\nSecurity Fix(es):  \n\n  * xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-93516)\n  * xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests (CVE-2026-93521)\n  * xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling (CVE-2026-88812)\n  * xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice (CVE-2026-93523)\n  * xorg-x11-server: glamor: size tmp_bits buffer for source coordinate range in upload_boxes (CVE-2026-93522)\n  * xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow (CVE-2026-93517)\n  * xorg-x11-server: xorg-x11-server: arbitrary code execution via integer truncation during keyboard mapping resize (CVE-2026-93518)\n  * xorg-x11-server: xorg-x11-server: Arbitrary code execution via buffer overflow in input_constrain_cursor() (CVE-2026-93519)\n  * xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling (CVE-2026-93520)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-19T00:00:00Z","modified":"2026-10-29T11:32:38.188331924Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"AZL-111461","title":"CVE-2026-93522 affecting package xorg-x11-server 1.20.10-6","description":"A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in the X server context.","status":"published","published":"2026-10-28T16:17:10Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"AZL-112297","title":"CVE-2026-93522 affecting package xorg-x11-server-Xwayland for versions less than 24.1.14-1","description":"A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in the X server context.","status":"published","published":"2026-10-28T16:17:10Z","modified":"2026-11-02T14:17:42.109287479Z","updated_at":"2026-11-02T15:28:02.666535Z"},{"id":"CLSA-2026-1792791669","title":"xorg-x11-server-Xwayland: Fix of 8 CVEs","description":"- CVE-2026-88812: Use-after-free/double free in XKB _CheckSetDoodad:\n  doodad text pointer left dangling after free when reading the font\n  string fails\n- CVE-2026-93516: Use-after-free in DIX: passive grabs keep dangling\n  pointers to a removed input device (grab-\u003edevice / modifierDevice)\n- CVE-2026-93517: Out-of-bounds read in GLX RenderLarge: dataBytes of\n  the first request not validated against the request length\n- CVE-2026-93518: Heap buffer overflow in XKB key resize: 16-bit\n  size_syms/num_syms/size_acts/num_acts truncate computed sizes,\n  undersizing allocations\n- CVE-2026-93519: Out-of-bounds write in XInput barrier handling:\n  input_constrain_cursor writes barrier events without a bounds check\n- CVE-2026-93521: Heap memory corruption in RandR\n  RRChangeProviderProperty PrependMode due to wrong size and offset when\n  shifting old data\n- CVE-2026-93522: Heap buffer overflow in glamor_upload_boxes: tmp_bits\n  sized from pixmap height, not the source coordinate range\n- CVE-2026-93523: Out-of-bounds access in XInput\n  ProcXIPassiveUngrabDevice: client-supplied modifier values are not\n  validated","status":"published","published":"2026-10-23T21:41:29Z","modified":"2026-10-26T09:31:37.102994719Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"MGASA-2026-0529","title":"Updated x11-server, x11-server-xwayland, tigervnc packages fixes security vulnerabilities and a regression that crashes the X server with AMD GPUs","description":"XKB SetGeometry TextDoodad Double Free. (CVE-2026-88812)\nPresent Extension Cross-Window Notify Use-After-Free. (CVE-2026-93515)\nXInput Passive Grab modifierDevice Use-After-Free. (CVE-2026-93516)\nGLX RenderLarge Heap Buffer Overflow. (CVE-2026-93517)\nXKB ResizeKeyType Numeric Truncation. (CVE-2026-93518)\nXFixes Pointer Barrier Event List Buffer Overflow. (CVE-2026-93519)\nXKB ChangeKeycodeRange Heap Out-of-Bounds Write. (CVE-2026-93520)\nRandR ChangeProviderProperty Heap Buffer Overflow. (CVE-2026-93521)\nGlamor CopyArea CPU-FBO Heap Buffer Overflow. (CVE-2026-93522)\nXInput2 PassiveUngrabDevice Modifier Out-of-Bounds Write.\n(CVE-2026-93523)\nXKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read.\n(CVE-2026-93524)\nGestureBuildSprite Use-After-Free. (CVE-2026-93536)\n","status":"published","published":"2026-10-20T15:57:48Z","modified":"2026-10-20T16:00:04.492555526Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:12105-1","title":"xwayland-24.1.13-2.1 on GA media","description":"These are all security issues fixed in the xwayland-24.1.13-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-10T00:00:00Z","modified":"2026-10-11T12:45:03.870211777Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:22085-1","title":"Security update for xwayland","description":"This update for xwayland fixes the following issues:\n\n- CVE-2026-88812: XKB SetGeometry TextDoodad Double Free (bsc#1281213).\n- CVE-2026-93515: X.Org Server Present Extension Use-After-Free (bsc#1281218).\n- CVE-2026-93516: X.Org Server XInput Passive Grab Use-After-Free (bsc#1281220).\n- CVE-2026-93517: GLX RenderLarge Heap Buffer Overflow (bsc#1281225).\n- CVE-2026-93518: XKB ResizeKeyType Numeric Truncation (bsc#1281227).\n- CVE-2026-93519: XFixes Pointer Barrier Event List Buffer Overflow (bsc#1281233).\n- CVE-2026-93520: XKB ChangeKeycodeRange Heap Out-of-Bounds Write (bsc#1281236).\n- CVE-2026-93521: RandR ChangeProviderProperty Heap Buffer Overflow (bsc#1281238).\n- CVE-2026-93522: Glamor CopyArea Heap Buffer Overflow (bsc#1281240).\n- CVE-2026-93523: XInput2 PassiveUngrabDevice Out-of-Bounds Write (bsc#1281241).\n- CVE-2026-93524: XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read (bsc#1281242).\n- CVE-2026-93536: GestureBuildSprite Use-After-Free (bsc#1281244).\n","status":"published","published":"2026-10-12T08:18:23Z","modified":"2026-10-19T17:23:13.53783248Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:24230-1","title":"Security update for xwayland","description":"This update for xwayland fixes the following issues:\n\n- CVE-2026-88812: XKB SetGeometry TextDoodad Double Free (bsc#1281213).\n- CVE-2026-93515: X.Org Server Present Extension Use-After-Free (bsc#1281218).\n- CVE-2026-93516: X.Org Server XInput Passive Grab Use-After-Free (bsc#1281220).\n- CVE-2026-93517: GLX RenderLarge Heap Buffer Overflow (bsc#1281225).\n- CVE-2026-93518: XKB ResizeKeyType Numeric Truncation (bsc#1281227).\n- CVE-2026-93519: XFixes Pointer Barrier Event List Buffer Overflow (bsc#1281233).\n- CVE-2026-93520: XKB ChangeKeycodeRange Heap Out-of-Bounds Write (bsc#1281236).\n- CVE-2026-93521: RandR ChangeProviderProperty Heap Buffer Overflow (bsc#1281238).\n- CVE-2026-93522: Glamor CopyArea Heap Buffer Overflow (bsc#1281240).\n- CVE-2026-93523: XInput2 PassiveUngrabDevice Out-of-Bounds Write (bsc#1281241).\n- CVE-2026-93524: XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read (bsc#1281242).\n- CVE-2026-93536: GestureBuildSprite Use-After-Free (bsc#1281244).\n","status":"published","published":"2026-10-12T08:18:20Z","modified":"2026-10-21T17:23:11.149658668Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:4835-1","title":"Security update for xwayland","description":"This update for xwayland fixes the following issues:\n\n- CVE-2026-88812: XKB SetGeometry TextDoodad Double Free (bsc#1281213).\n- CVE-2026-93515: X.Org Server Present Extension Use-After-Free (bsc#1281218).\n- CVE-2026-93516: X.Org Server XInput Passive Grab Use-After-Free (bsc#1281220).\n- CVE-2026-93517: GLX RenderLarge Heap Buffer Overflow (bsc#1281225).\n- CVE-2026-93518: XKB ResizeKeyType Numeric Truncation (bsc#1281227).\n- CVE-2026-93519: XFixes Pointer Barrier Event List Buffer Overflow (bsc#1281233).\n- CVE-2026-93520: XKB ChangeKeycodeRange Heap Out-of-Bounds Write (bsc#1281236).\n- CVE-2026-93521: RandR ChangeProviderProperty Heap Buffer Overflow (bsc#1281238).\n- CVE-2026-93522: Glamor CopyArea Heap Buffer Overflow (bsc#1281240).\n- CVE-2026-93523: XInput2 PassiveUngrabDevice Out-of-Bounds Write (bsc#1281241).\n- CVE-2026-93524: XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read (bsc#1281242).\n- CVE-2026-93536: GestureBuildSprite Use-After-Free (bsc#1281244).\n","status":"published","published":"2026-10-21T12:51:34Z","modified":"2026-10-22T11:45:03.857231817Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}