Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Xwayland can let attackers run code or gain admin rights
published 15 days ago
Summary
The Xwayland component in the Almalinux xorg-x11-server-xwayland package contains several flaws that could let a malicious program run its own code or increase its privileges on the system. This could lead to unauthorized access or control of the server. Install the latest security update for xorg-x11-server-xwayland as soon as possible to protect your environment.
What to do
- Update almalinux xorg-x11-server-xwayland to version 21.1.3-20.el8_10.4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:8 | almalinux | xorg-x11-server-xwayland |
< 21.1.3-20.el8_10.4 Fix: upgrade to 21.1.3-20.el8_10.4
|
Original advisory text
Important: xorg-x11-server-Xwayland security update
Xwayland is an X server for running X clients under Wayland.
Security Fix(es):
* xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-93516)
* xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests (CVE-2026-93521)
* xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling (CVE-2026-88812)
* xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice (CVE-2026-93523)
* xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow (CVE-2026-93517)
* xorg-x11-server: xorg-x11-server: arbitrary code execution via integer truncation during keyboard mapping resize (CVE-2026-93518)
* xorg-x11-server: xorg-x11-server: Arbitrary code execution via buffer overflow in input_constrain_cursor() (CVE-2026-93519)
* xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling (CVE-2026-93520)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-93516)
* xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests (CVE-2026-93521)
* xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling (CVE-2026-88812)
* xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice (CVE-2026-93523)
* xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow (CVE-2026-93517)
* xorg-x11-server: xorg-x11-server: arbitrary code execution via integer truncation during keyboard mapping resize (CVE-2026-93518)
* xorg-x11-server: xorg-x11-server: Arbitrary code execution via buffer overflow in input_constrain_cursor() (CVE-2026-93519)
* xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling (CVE-2026-93520)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2026:86907 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-88812 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-93516 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-93517 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-93518 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-93519 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-93520 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-93521 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-93523 Third Party Advisory
- https://bugzilla.redhat.com/2545161 Third Party Advisory
- https://bugzilla.redhat.com/2545164 Third Party Advisory
- https://bugzilla.redhat.com/2545174 Third Party Advisory
- https://bugzilla.redhat.com/2545177 Third Party Advisory
- https://bugzilla.redhat.com/2545246 Third Party Advisory
- https://bugzilla.redhat.com/2545860 Third Party Advisory
- https://bugzilla.redhat.com/2545887 Third Party Advisory
- https://bugzilla.redhat.com/2545908 Third Party Advisory
- https://errata.almalinux.org/8/ALSA-2026-86907.html Vendor Advisory
Timeline
Published21 Oct 2026
Updated21 Oct 2026
First seen21 Oct 2026
Sources
ALSA-2026:86907 · OSV
Track software like this
Free during beta