X.Org Security Advisory released for 9 new vulnerabilities in X.Org X server and Xwayland

Here we are again - X.Org X server and Xwayland have new security issues that have been revealed and patched in new versions released.

Announced by developer Peter Hutterer on June 2nd, xorg-server 21.1.23 and xwayland 24.1.12 have been released to fix up the problems (along with some other minor bug fixes in each). Most of the issues were found with the help of TrendAI, so we're seeing AI help more and more with discovering security issues across various open source projects.

We last had some security issues revealed back in April , and before that in October 2025 .

From the mailing list these are the new issues noted:

* Font Alias Stack-based Buffer Overflow

A mismatch between the X server and the libXfont2 library's maximum font name length can cause a stack buffer overflow during font alias resolution. The server allocates a 256 byte stack buffer but libXfont2's alias target name length is 1024 bytes. A font alias name between 257 and 1023 bytes causes the X server to copy that name into the undersized stack buffer without further checks.

Fixed in: xorg-server-21.1.23 and xwayland-24.1.12 Fix: Found by: Anonymous working with TrendAI Zero Day Initiative. (ZDI-CAN-30136)

* XSYNC Use-After-Free in miSyncDestroyFence()

A client that sets up multiple fence triggers can trigger a use-after-free function pointer call. An attacker would connect to the X server to set up a fence and await that fence, then a second X connection destroys the fence, causing the use-after-free.

Fixed in: xorg-server-21.1.23 and xwayland-24.1.12 Fix: Found by: Anonymous working with TrendAI Zero Day Initiative. (ZDI-CAN-30159)

* XKB Key Types Stack-based Buffer Overflow

The X server has multiple stack buffers that are sized XkbMaxShiftLevel * XkbNumKbdGroups but CheckKeyTypes() does not verify or clamp non-canonical key types to XkbMaxShiftLevel. A client can change key types to excessive shift levels and trigger three separate stack overflows.

This is caused by an incomplete fix of CVE-2025-26597.

Fixed in: xorg-server-21.1.23 and xwayland-24.1.12 Fix: Found by: Anonymous working with TrendAI Zero Day Initiative. (ZDI-CAN-30160)

* XKB SetMap Request Stack-based Buffer Overflow

_XkbSetMapChecks() declares a fixed-size stack buffer mapWidths[256] indexed by key type index. The helper function CheckKeyTypes() writes to this buffer at a client-controlled offset, allowing a stack buffer overflow.

Fixed in: xorg-server-21.1.23 and xwayland-24.1.12 Fix: Found by: Anonymous working with TrendAI Zero Day Initiative. (ZDI-CAN-30161)

* XSYNC Use-After-Free in FreeCounter()

A client that sets up multiple SyncCounters and awaits on those triggers can trigger a use-after-free when destroying those counters via a second client connection.

Fixed in: xorg-server-21.1.23 and xwayland-24.1.12 Fix: Found by: Anonymous working with TrendAI Zero Day Initiative. (ZDI-CAN-30163)

* XSYNC Use-After-Free in SyncChangeCounter()

A client that sets up multiple SyncCounters can trigger a use-after-free when destroying those counters via a second client connection while changing those counters.

Fixed in: xorg-server-21.1.23 and xwayland-24.1.12 Fix: Found by: Anonymous working with TrendAI Zero Day Initiative. (ZDI-CAN-30164)

* GLX ChangeDrawableAttributes Out-Of-Bounds Read/Write

A wrong size validation check in __glXDisp_ChangeDrawableAttributes() can read (or write) a client-controlled number of bytes, exceeding the request buffer.

The write path requires byte-swapped clients which is disabled by default.

The read can lead to information disclosure, the write can be used to crash the server, or for privilege escalation if the X server runs as root.

Fixed in: xorg-server-21.1.23 and xwayland-24.1.12 Fix: Found by: Anonymous working with TrendAI Zero Day Initiative. (ZDI-CAN-30165)

* CreateSaverWindow Use-After-Free Information Disclosure

A client can trigger a use-after-free read after changing window attributes and forcing the screen saver. This can lead to information disclosure.

Fixed in: xorg-server-21.1.23 and xwayland-24.1.12 Fix: Found by: Anonymous working with TrendAI Zero Day Initiative. (ZDI-CAN-30168)

* DRI2 DRIGetBuffers/DRIGetBuffersWithFormat Out-Of-Bounds Write

A client that requests multiple DRI2BufferBackLeft attachments and one DRI2BufferFrontLeft can trigger an out-of-bounds heap write.

Fixed in: xorg-server-21.1.23 and xwayland-24.1.12 Fix: Found by: Peter Hutterer, Red Hat.