Xorg X11 Server
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Xorg X11 Server.
By the Year
In 2026 there have been 11 vulnerabilities in Xorg X11 Server with an average score of 7.2 out of ten.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 11 | 7.19 |
It may take a day or so for new Xorg X11 Server vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Xorg X11 Server Security Vulnerabilities
A use after free caused by missing lifecycle management of gesture sprites in GestureBuildSprite() in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash the X server or potentially execute code.
CVE-2026-93536
5.3 - Medium
- October 28, 2026
A use after free caused by missing lifecycle management of gesture sprites in GestureBuildSprite() in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash the X server or potentially execute code.
Heap-based Buffer Overflow
A buffer overread in CheckKeySyms() in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to leak small amounts of information
CVE-2026-93524
6.9 - Medium
- October 28, 2026
A buffer overread in CheckKeySyms() in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to leak small amounts of information from X server memory or potentially crash the X server.
Buffer Over-read
A heap buffer overflow caused by a XIPassiveUngrabDevice request with an out-of-range modifier value in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.
CVE-2026-93523
7.8 - High
- October 28, 2026
A heap buffer overflow caused by a XIPassiveUngrabDevice request with an out-of-range modifier value in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.
Heap-based Buffer Overflow
A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in the X server context.
CVE-2026-93522
7.8 - High
- October 28, 2026
A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in the X server context.
Heap-based Buffer Overflow
A buffer overflow in RandR
ChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14 could be used by authenticated X clients to crash or execute code within the X server context.
CVE-2026-93521
7.8 - High
- October 28, 2026
A buffer overflow in RandR ChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14 could be used by authenticated X clients to crash or execute code within the X server context.
Heap-based Buffer Overflow
A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange in X.org X server before 2.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.
CVE-2026-93520
7.8 - High
- October 28, 2026
A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange in X.org X server before 2.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.
Heap-based Buffer Overflow
A buffer overflow when handling pointer barriers in the XFIXES extension in X.Org X server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.
CVE-2026-93519
7.8 - High
- October 28, 2026
A buffer overflow when handling pointer barriers in the XFIXES extension in X.Org X server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.
Heap-based Buffer Overflow
An integer truncation issue in XkbResizeKeyType()
CVE-2026-93518
7.8 - High
- October 28, 2026
An integer truncation issue in XkbResizeKeyType() that could lead to a heap buffer overflow by authenticated X clients in X.org X server before 21.1.25 and XWayland before 24.1.14 could be exploited for crashes or potential code execution in the X server.
Heap-based Buffer Overflow
X.org X Server XWayland UAF before 21.1.25/24.1.14
CVE-2026-93516
5.5 - Medium
- October 28, 2026
A use-after-free caused by lack of lifecycle management when adding / removing XInput master devices in X.org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X Clients to crash the X server or potentially execute code in X server context.
Dangling pointer
Use-After-Free in X.org X Server <21.1.25 (present_clear_window_notifies)
CVE-2026-93515
6.8 - Medium
- October 28, 2026
A use-after-free in present_clear_window_notifies() in the X.org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by malicious X clients to crash or potentially execute code in the X server context.
Dangling pointer
XKB Double Free in X.Org X Server <21.1.25 & XWayland <24.1.14
CVE-2026-88812
7.8 - High
- October 27, 2026
A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a crash or potentially code in the x server context.
Double-free
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Xorg X11 Server or by Xorg? Click the Watch button to subscribe.
