Buffer Overread Vulnerability in X.Org Xwayland and X Server
CVE-2026-109904

6.9MEDIUM

Key Information:

Vendor

X.org

Status
Xorg-x11-server
Xwayland
Vendor
CVE Published:
13 November 2026

What is CVE-2026-109904?

A vulnerability exists in the X.Org Xwayland and X Server products due to a buffer overread caused by an integer overflow in Proc/SProcXResQueryClientIds. This issue allows authenticated X clients to exploit the flaw, potentially leading to the crashing of the server or unauthorized information disclosure. Affected versions of X.Org xwayland before 24.1.15 and X Server before 21.1.26 are susceptible, necessitating prompt updates to mitigate risks.

Affected Version(s)

xorg-x11-server 0 < 21.1.26

xwayland 0 < 24.1.15

References

https://gitlab.freedesktop.org/xorg/xserver/-/commit/ff75...
patch

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Acts1631 <acts1631kjv@proton.me>
.