X.Org patches eight server vulnerabilities a month after fixing 12 others
X.Org has fixed eight vulnerabilities in the X.Org X server and Xwayland, including one in the Xorg server that lets a malicious monitor corrupt its memory. The fixes ship in xorg-server 21.1.26 and xwayland 24.1.15, and each of the eight affects versions before those two releases.
The X server provides the low-level display layer for graphical desktops on many Linux and Unix systems. Xwayland runs X11 applications on desktops built on Wayland, the newer display protocol, so Wayland users who run X11 applications are exposed too. The flaws can crash the server, corrupt its memory, or make it read or write outside the memory it should touch, and one can leak memory contents.
A monitor is the attack tool
CVE-2026-109091 sits in the code that reads EDID, the block of data a monitor sends to describe the resolutions and refresh rates it supports. The Xorg server copies a monitor’s display-range entries into fixed-size arrays without checking the count against the arrays’ limits. Feed it more entries than the arrays hold, from a rigged monitor or a crafted EDID, and the excess spills into neighboring data, which can crash the server or corrupt memory.
An attacker going after this flaw needs a malicious monitor, or a doctored EDID, in front of the server. The other seven flaws sit in the code that handles X protocol requests, the messages applications send to the X server.
Size checks that wrap around
Four of the seven are in Xv, the X Video extension applications use to pass video frames to the server. In CVE-2026-109092, a negative size from the server’s hardware-specific code plus a crafted offset wraps XvShmPutImage’s bounds check, letting the server read or write outside a shared memory segment. CVE-2026-109095, in the glamor acceleration code, computes image sizes with 32-bit integers that wrap to small values for large images, so the server reads past the data the client sent. CVE-2026-109096 and CVE-2026-109903 both start from a negative image size: one lets a request with no image data pass the length check, and the other reports the bogus size to the client, which may then allocate or use a buffer of the wrong size.
CVE-2026-109093 is an out-of-bounds stack write in XTest, the extension that lets clients inject fake keyboard and mouse events. The server copies input values into a fixed-size stack array before checking that they fit. The last two, CVE-2026-109904 and CVE-2026-109094, are integer overflows in the X-Resource extension. On 32-bit servers, a large count wraps so a short request passes the length check, and the server reads or walks past the end of the request buffer.
No severity ratings
X.Org published no severity ratings or CVSS scores and did not say whether any of the eight could lead to code execution. Admins have to rank the bugs themselves, and the three that can write out of bounds, CVE-2026-109091, -109092 and -109093, are the ones to weigh first.
X.Org released xorg-server 21.1.26 about a month after 21.1.25, which fixed 12 flaws. Anyone who installed that update in October has another one to install now. Distributions usually backport the patches into their own package versions, so look for the CVE numbers in your distribution’s advisory.
