X.Org fixes eight X server and Xwayland memory flaws
Original title: X.Org patches eight server vulnerabilities a month after fixing 12 others
Fixes are in xorg-server 21.1.26 and xwayland 24.1.15; X.Org gave no severity scores or exploitation status.
X.Org patched eight vulnerabilities in the X.Org X server and Xwayland, all affecting versions before xorg-server 21.1.26 and xwayland 24.1.15. The bugs can crash the server, corrupt memory, read or write out of bounds, or leak memory. CVE-2026-109091 is in EDID handling: a malicious monitor or crafted EDID can overflow fixed-size display-range arrays. The other seven are in X protocol request handling, including Xv, glamor, XTest, and the X-Resource extension. X.Org published no severity ratings and did not say whether any flaw allows code execution. This follows xorg-server 21.1.25, which fixed 12 flaws about a month earlier.
Unconfirmed: X.Org did not say whether any of the eight flaws can lead to code execution.
- CVE-2026-109092 wraps an XvShmPutImage bounds check and can access shared memory out of bounds.
- CVE-2026-109093 is an out-of-bounds stack write in the XTest extension.
- CVE-2026-109904 and CVE-2026-109094 are integer overflows on 32-bit servers in X-Resource.
- Wayland users who run X11 apps through Xwayland are exposed.
- Distributions often backport fixes, so match CVE numbers in distro advisories.
Impact: Server crash, memory corruption, out-of-bounds access, or a memory leak
| Product | Affected | Fixed in |
|---|---|---|
| X.Org xorg-server | before 21.1.26 | 21.1.26 |
| X.Org xwayland | before 24.1.15 | 24.1.15 |
- 1.Upgrade to xorg-server 21.1.26 and xwayland 24.1.15, or the distribution backport.
- 2.Prioritize CVE-2026-109091, CVE-2026-109092, and CVE-2026-109093, which can write out of bounds.
- CVEs
- CVE-2026-109091CVE-2026-109092CVE-2026-109093CVE-2026-109094CVE-2026-109095CVE-2026-109096CVE-2026-109903CVE-2026-109904
- Vendors
- X.Org
- Products
- xorg-serverXwayland
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-109091 | — | — | — | ||
| CVE-2026-109092 | — | — | — | ||
| CVE-2026-109093 | — | — | — | ||
| CVE-2026-109094 | — | — | — | ||
| CVE-2026-109095 | — | — | — | ||
| CVE-2026-109096 | — | — | — | ||
| CVE-2026-109903 | — | — | — | ||
| CVE-2026-109904 | — | — | — |
From the original article
2 min read at helpnetsecurity.com
X. Org has fixed eight vulnerabilities in the X. Org X server and Xwayland, including one in the Xorg server that lets a malicious monitor corrupt its memory.
By Anamarija Pogorelec · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.