Eight More Security Issues Made Public For The X.Org Server / XWayland

With the assistance of AI/LLMs, eight more security vulnerabilities were made public today for the X.Org Server. These issues also end up affecting the XWayland code too.

Various security researchers have spotted eight more issues in the xorg-server codebase, growing the already very long list of X.Org Server security issues that have come to light in the past decade.

CVE-2026-109091: X.Org Server EDID DS_RANGES Out-Of-Bounds Write

CVE-2026-109092: X.Org Server XvShmPutImage Shared-Memory Bounds Overflow

CVE-2026-109093: X.Org Server XTestFakeInput Valuator Stack Out-Of-Bounds Write

CVE-2026-109904: X.Org Server XRes QueryClientIds Request Size Overflow

CVE-2026-109094: X.Org Server XRes QueryResourceBytes Swap Path Size Overflow

CVE-2026-109095: X.Org Server glamor Xv Image Size Integer Overflow

CVE-2026-109096: X.Org Server XvPutImage Negative Image Size Length Bypass

CVE-2026-109903: X.Org Server XvQueryImageAttributes Negative Size

More details for those interested via the

. These latest security issues are fixed in xorg-server-21.1.26 and xwayland-24.1.15.