Buffer Overflow Vulnerability in X.Org X Server and XWayland
CVE-2026-93521

7.8HIGH

Key Information:

Vendor

X.org

Status
Xorg-x11-server
Xwayland
Vendor
CVE Published:
28 October 2026

What is CVE-2026-93521?

A buffer overflow vulnerability has been identified in the ChangeProviderProperty requests processed by the X.Org X Server prior to version 2.1.25 and XWayland prior to version 24.4.14. This weakness allows authenticated X clients to potentially crash the X server or execute arbitrary code within its context, posing significant security risks. When exploited, this vulnerability can compromise the integrity and availability of the affected systems, highlighting the necessity for prompt updates and security patches.

Affected Version(s)

xorg-x11-server 0 < 21.1.25

xwayland 0 < 24.1.14

References

https://gitlab.freedesktop.org/xorg/xserver/-/commit/5dc9...
patch

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Anonymous working with TrendAI Zero Day Initiative
.