Xorg

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Xorg product.

RSS Feeds for Xorg security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Xorg products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Xorg Sorted by Most Security Vulnerabilities since 2018

Xorg Server46 vulnerabilities

Xorg Xwayland37 vulnerabilities

Xorg X Server31 vulnerabilities

Xorg X11 Server19 vulnerabilities

Xorg Libx1117 vulnerabilities

Xorg X1113 vulnerabilities

Xorg Libxi12 vulnerabilities

Xorg Libxpm7 vulnerabilities

Xorg Xfree865 vulnerabilities

Xorg Libxfont23 vulnerabilities

Xorg Libxtst2 vulnerabilities

Xorg X Window System1 vulnerability

Xorg Xterm1 vulnerability

Xorg Xserver1 vulnerability

Xorg X11r61 vulnerability

Xorg X Font Server1 vulnerability

Xorg Libxrender1 vulnerability

Xorg Libxdmcp1 vulnerability

By the Year

In 2026 there have been 42 vulnerabilities in Xorg with an average score of 7.2 out of ten. Last year, in 2025 Xorg had 13 security vulnerabilities published. That is, 29 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 0.24

Year	Vulnerabilities	Average Score
2026	42	7.18
2025	13	7.43
2024	10	7.67
2023	16	7.04
2022	9	7.96
2021	8	7.95
2020	8	7.38
2019	1	0.00
2018	5	5.50

It may take a day or so for new Xorg vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Xorg Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-109091	Nov 13, 2026	X.Org XServer & Xwayland <21.1.26 / <24.1.15 Buffer Overflow in EDID A buffer overflow in handling EDID Display-Range descriptors in X.Org xwayland before 24.1.15 and X Server before 21.1.26 could be used by malicious monitors to crash the x server or execute cote.	Xwayland Xorg X11 Server
CVE-2026-109092	Nov 13, 2026	X.Org XServer/Xwayland <21.1.26,24.1.15 Negative Size ProcXvShmPutImage RCE Incorrectly handled negative sizes when processing ProcXvShmPutImage requests in the X.Org xwayland before 24.1.15 and X Server before 21.1.26 could be used by local authenticated X clients to crash the X server or execute code.	Xwayland Xorg X11 Server
CVE-2026-109093	Nov 13, 2026	X.Org XWayland (24.1.15) & X Server (21.1.26) Stack Buffer Overflow A stack buffer overflow in ProcXTestFakeInput DeviceValuator handling in X.Org xwayland before 24.1.15 and X server before 21.1.26 could be used by authenticated clients to crash or execute code in the X server.	Xwayland Xorg X11 Server
CVE-2026-109094	Nov 13, 2026	X.Org Xwayland/X Server <24.1.15,21.1.26> Integer Overflow in XRes A integer overflow that can lead to a buffer overrread in the XRes QueryResourceBytes Swap Path in the X.Org xwayland before 24.1.15 and X Server before 21.1.26 on 32bit systems could be used by authenticated clients to crash the X server.	Xwayland Xorg X11 Server
CVE-2026-109095	Nov 13, 2026	X.Org X Server/Xwayland glamor Xv Image Size integer overflow (pre24.1.15, pre21.1.26) A integer overflow in glamor Xv Image Size handling in X.Org xwayland before 24.1.15 and X server before 21.1.26 could be used by authenticated clients to crash the X server or leak out data.	Xwayland Xorg X11 Server
CVE-2026-109096	Nov 13, 2026	X.Org X Server/Xwayland <21.1.26 & <24.1.15 ddQueryImageAttributes() Crash Incorrect handling of negative returns from ddQueryImageAttributes() when processing XvPutImage requests in X.Org xwayland before 24.1.15 and X Server before 21.1.26 could be used by authenticated X clients to crash the X server.	Xwayland Xorg X11 Server
CVE-2026-109903	Nov 13, 2026	X.Org X Server XvQueryImageAttributes buffer overread before 21.1.26 A buffer overread caused by casting a negative integer to CARD32 in XvQueryImageAttributes in X.Org X Server before 21.1.26 and xwayland before 24.1.15 could be used to causes crashes by authenticated X clients.	Xwayland Xorg X11 Server
CVE-2026-109904	Nov 13, 2026	X.Org Xwayland/X Server <24.1.15/21.1.26 Integer Overflow Buffer Overread A buffer overread caused by an integer-overflow in Proc/SProcXResQueryClientIds in X.Org xwayland before 24.1.15 and X Server before 21.1.26 could be used by attackers on authenticated X clients to crash the server or leak out information.	Xorg X11 Server Xwayland
CVE-2026-93536	Oct 28, 2026	Use-After-Free in X.Org X Server <21.1.25 via GestureBuildSprite() A use after free caused by missing lifecycle management of gesture sprites in GestureBuildSprite() in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash the X server or potentially execute code.	Xorg X11 Server Xwayland
CVE-2026-93524	Oct 28, 2026	X.Org X Server buffer overread in CheckKeySyms() before 21.1.25 A buffer overread in CheckKeySyms() in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to leak small amounts of information from X server memory or potentially crash the X server.	Xorg X11 Server Xwayland
CVE-2026-93523	Oct 28, 2026	X.Org X Server <21.1.15 Heap Buffer Overflow via XIPassiveUngrabDevice A heap buffer overflow caused by a XIPassiveUngrabDevice request with an out-of-range modifier value in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.	Xorg X11 Server Xwayland
CVE-2026-93522	Oct 28, 2026	X.Org X Server <=21.1.15: CPU-to-FBO Heap Overflow A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in the X server context.	Xorg X11 Server Xwayland
CVE-2026-93521	Oct 28, 2026	X.Org X Server <2.1.25 Buffer Overflow in RandR ChangeProviderProperty A buffer overflow in RandR ChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14 could be used by authenticated X clients to crash or execute code within the X server context.	Xorg X11 Server Xwayland
CVE-2026-93520	Oct 28, 2026	X.org XServer Heap Overflow XkbAllocNames/ChangeKeycodeRange pre 2.1.25 A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange in X.org X server before 2.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.	Xorg X11 Server Xwayland
CVE-2026-93519	Oct 28, 2026	X.Org X Server Buffer Overrun in XFIXES (21.1.25) A buffer overflow when handling pointer barriers in the XFIXES extension in X.Org X server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.	Xorg X11 Server
CVE-2026-93518	Oct 28, 2026	X Server Heap BOF via Integer Truncation in XkbResizeKeyType() (pre-21.1.25) An integer truncation issue in XkbResizeKeyType() that could lead to a heap buffer overflow by authenticated X clients in X.org X server before 21.1.25 and XWayland before 24.1.14 could be exploited for crashes or potential code execution in the X server.	Xorg X11 Server Xwayland
CVE-2026-93517	Oct 28, 2026	X.org X Server: Heap Buffer Overflow in GLX RenderLarge before 21.1.25 A heap buffer overflow in handling GLX RenderLarge request where dataBytes exceeds cmdlen in X.org X server before 21.1.25 and XWayland before 24.1.14 that could be be triggered by an authenticated X client could cause crashes or code execution in X server context.	Xwayland
CVE-2026-93516	Oct 28, 2026	X.org X Server XWayland UAF before 21.1.25/24.1.14 A use-after-free caused by lack of lifecycle management when adding / removing XInput master devices in X.org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X Clients to crash the X server or potentially execute code in X server context.	Xorg X11 Server Xwayland
CVE-2026-93515	Oct 28, 2026	Use-After-Free in X.org X Server <21.1.25 (present_clear_window_notifies) A use-after-free in present_clear_window_notifies() in the X.org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by malicious X clients to crash or potentially execute code in the X server context.	Xorg X11 Server Xwayland
CVE-2026-88812	Oct 27, 2026	XKB Double Free in X.Org X Server <21.1.25 & XWayland <24.1.14 A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a crash or potentially code in the x server context.	Xorg X11 Server Xwayland
CVE-2026-109090	Oct 27, 2026	libXi < 1.8.4 Heap Overflow via DEVICE_ENABLE Reply A malicious X server could cause a heap overflow by injecting a large DEVICE_ENABLE reply when processed by libXi before 1.8.4.	Libxi
CVE-2026-109088	Oct 27, 2026	X.org libXtst <1.2.6 parse_reply_call_callback infinite loop A malicious X server could send malformed RECORD EnableContext reolies that can cause a X client using the parse_reply_call_callback function in libXtst before 1.2.6 to enter a endless loop.	Libxtst
CVE-2026-109089	Oct 27, 2026	X.Org libXi <1.8.4 Heap Buffer Overflow (DEVICE_RESOLUTION) A buffer overflow when handling DEVICE_RESOLUTION in libXi before 1.8.4 could overflow a heap, triggered by a malicious X server.	Libxi
CVE-2026-94287	Sep 28, 2026	libXpm DoS via unsigned underflow in write path (before 3.5.19) A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion.	Libxpm
CVE-2026-94286	Sep 28, 2026	Out-of-Bounds Read in libXtst RECORD Parser (<=1.2.5) An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients.	Libxtst
CVE-2026-94285	Sep 28, 2026	libX11 <=1.8.13 OOB Read via Codeset Parser (xorg) An out-of-bounds read in libX11's byte-oriented codeset parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients.	Libx11
CVE-2026-94284	Sep 28, 2026	Out-of-Bounds Read in libX11 XIM Trigger-Key Parser (before 1.8.14) An out-of-bounds read vulnerability in libX11's XIM trigger-key registration parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients.	Libx11
CVE-2026-94283	Sep 28, 2026	libX11 OOB Read via XIM Atr Parser <1.8.14 (CVE-2026-94283) An out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients.	Libx11
CVE-2026-94282	Sep 28, 2026	Out-of-Bounds Read in libXi <1.8.4 via XI2 Cookie Conversion An out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion in libXi before 1.8.4 could be used by malicious X server to crash an attached X client.	Libxi
CVE-2026-94281	Sep 24, 2026	Out-of-Bounds Read in libXi XListInputDevices() before 1.8.4 An out-of-bounds read in libXi's XListInputDevices() class parsing in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.	Libxi
CVE-2026-93545	Sep 24, 2026	Out-of-Bounds Read in libXi <1.8.4 XListInputDevices Crash An out-of-bounds read in libXi's XListInputDevices() in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.	Libxi
CVE-2026-93544	Sep 24, 2026	LibXi OOB Read via XIQueryDevice before 1.8.4 An out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing in libXi before 1.8.4 can be used by a malicious X server to crash an attached X client.	Libxi
CVE-2026-93543	Sep 24, 2026	libXi <1.8.4 OOB Read in XI2 Class Parser An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.	Libxi
CVE-2026-93542	Sep 24, 2026	Out-of-Bounds Read in libXi (before 1.8.4) via XI2 Class Parsing An out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_classes() in libXi before 1.8.4 could be used by malicous servers to crash the X client.	Libxi
CVE-2026-93541	Sep 24, 2026	Out-of-bounds read in libXi XQueryDeviceState (<1.8.4) An out-of-bounds read in libXi's XQueryDeviceState() in libXi before 1.8.4 could be used by a	Libxi
CVE-2026-88807	Sep 21, 2026	Heap Overflow in Xrender <0.9.13 Enables Code Injection A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients.	Libxrender
CVE-2026-88806	Sep 21, 2026	Buffer Overflow in libX11 <1.8.14 (XkbGetMap) A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map.	Libx11
CVE-2026-56003	Jul 08, 2026	libXfont2 <2.0.8: Heap BOV in ComputeScaledProperties PCF parsing A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2 ComputeScaledProperties() before libXfont2 before 2.0.8 could be used by attackers using authenticated X clients to execute code within the X server.	Libxfont2
CVE-2026-56002	Jul 08, 2026	libXfont2 heap buffer overflow in pcfReadFont() before 2.0.8 (X exec) A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8 allows attackers authenticated as X client to execute code within the X server.	Libxfont2
CVE-2026-56001	Jul 08, 2026	Heap Buffer Overflow in libXfont2 <2.0.8 (BitmapScaleBitmaps) X Server RCE A heap buffer overflow in BitmapScaleBitmaps in libXfont2 before 2.0.8 due to an overflowing 32bit size could be used by attackers able to access the X Server to execute code within the X server cont	Libxfont2
CVE-2026-55999	Jul 08, 2026	Local Heap Overflow via PCX Font in Xorg-Server <21.2.24 (SetFont) Local attackers with a X connection able to provide PCX fonts to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a heap buffer overflow via SetFont due to missing glyph boundary checks.	Xorg Server Xwayland
CVE-2026-56000	Jul 08, 2026	Heap UAF in xorg-server/xwayland <21.2.24/24.1.13 via GLX commit Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a Heap Use After Free, due to CommonMakeCurrent() pointing into potentially reallocated memory.	X11 Xwayland
CVE-2025-62230	Oct 30, 2025	X.Org X Server Xkb Extension Use-After-Free on Client Cleanup A flaw was discovered in the X.Org X servers X Keyboard (Xkb) extension when handling client resource cleanup. The software frees certain data structures without properly detaching related resources, leading to a use-after-free condition. This can cause memory corruption or a crash when affected clients disconnect.	Xorg Server
CVE-2025-49177	Jun 17, 2025	X11 XFixes Extension Memory Read via Request Length Omission A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests.	Xorg Server
CVE-2025-49178	Jun 17, 2025	X Server 'bytes to ignore' flaw to DoS A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' in a client's request can cause the server to skip processing another client's request, potentially leading to a denial of service.	Xorg Server
CVE-2025-49180	Jun 17, 2025	Xorg RandR RRChangeProviderProperty Integer Overflow A flaw was found in the RandR extension, where the RRChangeProviderProperty function does not properly validate input. This issue leads to an integer overflow when computing the total size to allocate.	Xorg Server
CVE-2022-49737	Mar 16, 2025	X.Org X Server 20.11-21.1.16 Input Race via Easystroke In X.Org X server 20.11 through 21.1.16, when a client application uses easystroke for mouse gestures, the main thread modifies various data structures used by the input thread without acquiring a lock, aka a race condition. In particular, AttachDevice in dix/devices.c does not acquire an input lock.	Xorg Server
CVE-2025-26595	Feb 25, 2025	X.Org Xwayland Buffer Overflow via XkbVModMaskText A buffer overflow flaw was found in X.Org and Xwayland. The code in XkbVModMaskText() allocates a fixed-sized buffer on the stack and copies the names of the virtual modifiers to that buffer. The code fails to check the bounds of the buffer and would copy the data regardless of the size.	X Server Xwayland
CVE-2025-26596	Feb 25, 2025	Heap Overflow in X.Org X Server XkbSizeKeySyms Length Calc A heap overflow flaw was found in X.Org and Xwayland. The computation of the length in XkbSizeKeySyms() differs from what is written in XkbWriteKeySyms(), which may lead to a heap-based buffer overflow.	X Server Xwayland
CVE-2025-26597	Feb 25, 2025	Buffer Overflow in X.Org Xwayland via XkbChangeTypesOfKey() misuse A buffer overflow flaw was found in X.Org and Xwayland. If XkbChangeTypesOfKey() is called with a 0 group, it will resize the key symbols table to 0 but leave the key actions unchanged. If the same function is later called with a non-zero value of groups, this will cause a buffer overflow because the key actions are of the wrong size.	X Server Xwayland