Buffer Overflow Vulnerability in X.Org xwayland and X Server Products
CVE-2026-109091

7.8HIGH

Key Information:

Vendor

X.org

Status
Xwayland
Xorg-x11-server
Vendor
CVE Published:
13 November 2026

What is CVE-2026-109091?

A buffer overflow vulnerability has been identified in the handling of EDID Display-Range descriptors in X.Org xwayland versions prior to 24.1.15 and X Server versions before 21.1.26. This defect could allow a malicious monitor to potentially disrupt the X server operation, resulting in crashes or the execution of arbitrary code. It is crucial for users of affected versions to apply the necessary updates promptly to mitigate any associated risks.

Affected Version(s)

xorg-x11-server 0 < 21.1.26

xwayland 0 < 24.1.15

References

https://gitlab.freedesktop.org/xorg/xserver/-/commit/56e4...
patch
https://gitlab.freedesktop.org/xorg/xserver/-/commit/d88f...
patch

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Eun0us / Espilon <eun0us@espilon.net>
.