Check your X.Org server version because a dozen vulnerabilities have been patched
X.Org patched 12 X server and Xwayland flaws, including nine that can allow arbitrary code execution.
X.Org fixed 12 security flaws in the X server and Xwayland, released in xorg-server 21.1.25 and xwayland 24.1.14. Nine can lead to arbitrary code execution, while the other three can crash the server or disclose information. The bugs include seven buffer overflows or out-of-bounds writes, three use-after-free issues, one double free, and one out-of-bounds read; ten say an authenticated X client can trigger the flaw. CVE-2026-93522, a heap overflow in Glamor CopyArea, affects only Xwayland, and CVE-2026-93520 and CVE-2026-93521 finish incomplete earlier fixes.
- Fixes ship in xorg-server 21.1.25 and xwayland 24.1.14
- Nine of 12 flaws can lead to arbitrary code execution
- Ten require an already authenticated X client
- CVE-2026-93522, a Glamor heap overflow, affects only Xwayland
- Two fixes complete earlier incomplete patches
Vulnerabilities mentionedAll →
- published —
- published —
- published —
Full article231 words · extracted from helpnetsecurity.com · click to collapse
X.Org fixed 12 security flaws in the X server and Xwayland, with the repairs shipping in xorg-server 21.1.25 and xwayland-24.1.14. Nine of the flaws can lead to arbitrary code execution. The other three can crash the server or disclose information.
Ten of the 12 entries say an authenticated X client can trigger the flaw, meaning a program the server already accepts a connection from. The entries for CVE-2026-93524 and CVE-2026-93536 do not state that condition. Eleven of the 12 affect both the X server and Xwayland. CVE-2026-93522, a heap buffer overflow in Glamor’s CopyArea code on GPU-accelerated systems, affects only Xwayland.
What the bugs are
Seven are buffer overflows or out-of-bounds writes, three are use-after-free bugs (the server keeps using memory it already released), one is a double free, and one is an out-of-bounds read. Two flaws depend on extensions the advisory says are on by default: CVE-2026-93515 needs Present and SYNC, and CVE-2026-93519 needs XFIXES and XTEST plus more than 100 active pointer barriers.
Two of the fixes finish earlier work. CVE-2026-93520 comes from an incomplete fix in commit a3171732d. CVE-2026-93521 repeats a bug pattern already fixed in RRChangeOutputProperty. The RandR output path got the fix; the provider path did not.
What to check
If you run the X server or Xwayland, compare your installed version with 21.1.25 and 24.1.14. Each CVE entry links its fix commit on freedesktop.org GitLab.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2026/10/07/x-org-server-fixed-vulnerabilities/