Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2026-93521: X.Org Server and XWayland may be crashed or hijacked
CVE-2026-93521 · published 7 days ago
Summary
The X.Org X Server (versions before 2.1.25) and XWayland (versions before 24.4.14) have a flaw that lets a program already allowed to talk to them write past the end of a memory area. This can cause the display server to stop working or run the program’s code, giving the attacker control of the desktop session. Install the latest updates for the xorg-server and xwayland packages from your Linux distribution (Debian, Ubuntu) to fix the problem.
What to do
- Update bellsoft xorg-server to version 21.1.25-r0.
- Update debian xorg-server to version 2:21.1.25-1.
- Update debian xwayland to version 2:24.1.14-1.
- Update x.org xorg-x11-server to version 21.1.25 or later.
- Update x.org xwayland to version 24.1.14 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:13 | debian | xwayland | All versions |
| Debian:14 | debian | xwayland |
< 2:24.1.14-1 Fix: upgrade to 2:24.1.14-1
|
| Debian:12 | debian | xorg-server | All versions |
| Debian:13 | debian | xorg-server | All versions |
| Debian:14 | debian | xorg-server |
< 2:21.1.25-1 Fix: upgrade to 2:21.1.25-1
|
| Debian:12 | debian | xwayland | All versions |
| Ubuntu:Pro:14.04:LTS | canonical | xorg-server | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | xorg-server-hwe-16.04 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | xorg-server-hwe-18.04 | All versions |
| Ubuntu:22.04:LTS | canonical | xwayland | All versions |
| Alpaquita:23 | bellsoft | xorg-server |
>= 21.1.4-r1, < 21.1.25-r0 Fix: upgrade to 21.1.25-r0
|
| Alpaquita:25 | bellsoft | xorg-server |
>= 21.1.16-r0, < 21.1.25-r0 Fix: upgrade to 21.1.25-r0
|
| – | x.org | xorg-x11-server | < 21.1.25 |
| – | x.org | xwayland | < 24.1.14 |
Original advisory text
X.Org Server RandR ChangeProviderProperty Heap Buffer Overflow
A buffer overflow in RandR
ChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14 could be used by authenticated X clients to crash or execute code within the X server context.
ChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14 could be used by authenticated X clients to crash or execute code within the X server context.
References
- https://ubuntu.com/security/CVE-2026-93521 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-93521 Third Party Advisory
- https://lists.x.org/archives/xorg-announce/2026-October/003747.html Third Party Advisory
- https://docs.bell-sw.com/security/cves/CVE-2026-93521 Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-93521 Vendor Advisory
- https://gitlab.freedesktop.org/xorg/xserver/-/commit/5dc9efd5a199717b53f70b9c6cd... Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93521... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-93521 Vendor Advisory
- https://gitlab.freedesktop.org/xorg/xserver Product
Severity
7.8
High
Type
CWE-122Heap-based Buffer Overflow
Timeline
Published28 Oct 2026
Updated31 Oct 2026
First seen7 Oct 2026
Sources
DEBIAN-CVE-2026-93521 · OSV
UBUNTU-CVE-2026-93521 · OSV
BELL-CVE-2026-93521 · OSV
CVE-2026-93521 · NVD
CVE-2026-93521 · MITRE
CVE-2026-93521 · OSV
Track software like this
Free during beta