Xorg Announce 2026 November 003759

lists.x.org • November 10, 2026

message (by thread): [ANNOUNCE] xorg-server 21.1.26 Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] ======================================================================== X.Org Security Advisory: November 10, 2026 Issues in X.Org X server prior to xorg-server-21.1.26 and Xwayland prior to xwayland-24.1.15 ======================================================================== * CVE-2026-109091: X.Org Server EDID DS_RANGES Out-Of-Bounds Write The Xorg server records EDID Display-Range (DS_RANGES) descriptors into fixed-size MonRec hsync[] / vrefresh[] arrays without checking against MAX_HSYNC / MAX_VREFRESH. A malicious monitor or crafted EDID can supply extra descriptors that overrun those arrays and clobber adjacent MonRec fields (Modes, Last, DDC), causing an out-of-bounds write that can crash the server or corrupt memory. Fixed in: xorg-server-21.1.26 and xwayland-24.1.15 Fix: Found by: Eun0us / Espilon * CVE-2026-109092: X.Org Server XvShmPutImage Shared-Memory Bounds Overflow ProcXvShmPutImage checked (size_needed + offset) against the SHM segment size. A negative size_needed from the DDX plus a crafted offset wraps that addition so the bounds check passes and an invalid source pointer is passed to PutImage, enabling an out-of-bounds read or write in the X server. Fixed in: xorg-server-21.1.26 and xwayland-24.1.15 Fix: Found by: Acts1631 * CVE-2026-109093: X.Org Server XTestFakeInput Valuator Stack Out-Of-Bounds Write ProcXTestFakeInput copied DeviceValuator fields into a fixed stack array (MAX_VALUATORS) before checking that the valuator range fits. Enough DeviceValuator events write past that array, which can crash the server or corrupt stack memory. Fixed in: xorg-server-21.1.26 and xwayland-24.1.15 Fix: Found by: Acts1631 * CVE-2026-109904: X.Org Server XRes QueryClientIds Request Size Overflow Proc/SProcXResQueryClientIds multiply numSpecs by the spec size before REQUEST_FIXED_SIZE without an overflow check. On 32-bit servers a large numSpecs wraps so a short request passes length validation and the handler reads past the request buffer, which can crash the server or leak/process unintended memory. Fixed in: xorg-server-21.1.26 and xwayland-24.1.15 Fix: Found by: Acts1631 * CVE-2026-109094: X.Org Server XRes QueryResourceBytes Swap Path Size Overflow SProcXResQueryResourceBytes multiplied numSpecs by the spec size before REQUEST_FIXED_SIZE without an overflow check. On 32-bit servers a large numSpecs wraps and the swap loop walks past the request buffer, which can crash the server or corrupt memory. Fixed in: xorg-server-21.1.26 and xwayland-24.1.15 Fix: * CVE-2026-109095: X.Org Server glamor Xv Image Size Integer Overflow glamor_xv_query_image_attributes() computed NV12 / YV12 image sizes with 32-bit ints. Large width/height values wrap to a small positive size, so protocol length checks can accept PutImage / ShmPutImage requests that lack the claimed payload, leading to out-of-bounds reads in the X server. Fixed in: xorg-server-21.1.26 and xwayland-24.1.15 Fix: Found by: Tristan Madani (Talence Security) * CVE-2026-109096: X.Org Server XvPutImage Negative Image Size Length Bypass When ddQueryImageAttributes() returns a negative size, ProcXvPutImage adds it to the header size so the length check can accept a request with no image payload, causing the server to process missing image data and potentially crash or misbehave. Fixed in: xorg-server-21.1.26 and xwayland-24.1.15 Fix: Found by: Tristan Madani (Talence Security) * CVE-2026-109903: X.Org Server XvQueryImageAttributes Negative Size When ddQueryImageAttributes() returns a negative size, ProcXvQueryImageAttributes still replies with that value cast to CARD32, advertising a bogus data_size instead of returning an error. Clients may then allocate or use the wrong buffer size based on that . Fixed in: xorg-server-21.1.26 and xwayland-24.1.15 Fix: Found by: Tristan Madani (Talence Security) ======================================================================== X.Org thanks all of those who reported and fixed these issues, and those who helped review and release this advisory and these fixes. message (by thread): [ANNOUNCE] xorg-server 21.1.26 Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] More information the xorg-announce mailing list

message (by thread): [ANNOUNCE] xorg-server 21.1.26

Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

message (by thread): [ANNOUNCE] xorg-server 21.1.26 Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] More information the xorg-announce mailing list

message (by thread): [ANNOUNCE] xorg-server 21.1.26

Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Eight New Security Vulnerabilities Disclosed for X.Org Server and XWayland On November 10, 2026, eight new security vulnerabilities were disclosed for the X.Org Server and XWayland, affecting various components of the software. The vulnerabilities include CVE-2026-109091, an out-of-bounds write issue, and CVE-2026-109092, which allows for shared-memory bounds overflow. These vulnerabilities could lead to server crashes or memory corruption if exploited. The issues were identified by security researchers and have been addressed in the latest versions: xorg-server-21.1.26 and xwayland-24.1.15. Users are urged to update their systems to mitigate potential risks. The vulnerabilities are part of a growing list of security issues affecting the X.Org Server over the past decade. 1 sources 34

Extracted Entities

Xorg Announce 2026 November 003759

The full story

Extracted Entities

CVEs (8)

CWE Weaknesses (3)

Domains (1)

Platforms (1)