Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
Related vulnerabilities
ALSA-2026:85191
Vulnerability from osv_almalinux – Published: 2026-10-19 00:00 – Updated: 2026-10-20 09:09 – Source website
VLAI
Summary
Important: xorg-x11-server-Xwayland security update
Details
Xwayland is an X server for running X clients under Wayland.
Security Fix(es):
- xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-93516)
- xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests (CVE-2026-93521)
- xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling (CVE-2026-88812)
- xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice (CVE-2026-93523)
- xorg-x11-server: glamor: size tmp_bits buffer for source coordinate range in upload_boxes (CVE-2026-93522)
- xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow (CVE-2026-93517)
- xorg-x11-server: xorg-x11-server: arbitrary code execution via integer truncation during keyboard mapping resize (CVE-2026-93518)
- xorg-x11-server: xorg-x11-server: Arbitrary code execution via buffer overflow in input_constrain_cursor() (CVE-2026-93519)
- xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling (CVE-2026-93520)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
{
"affected": [
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "xorg-x11-server-Xwayland"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "24.1.9-4.el10_2.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "xorg-x11-server-Xwayland-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "24.1.9-4.el10_2.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"details": "Xwayland is an X server for running X clients under Wayland. \n\nSecurity Fix(es): \n\n * xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-93516)\n * xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests (CVE-2026-93521)\n * xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling (CVE-2026-88812)\n * xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice (CVE-2026-93523)\n * xorg-x11-server: glamor: size tmp_bits buffer for source coordinate range in upload_boxes (CVE-2026-93522)\n * xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow (CVE-2026-93517)\n * xorg-x11-server: xorg-x11-server: arbitrary code execution via integer truncation during keyboard mapping resize (CVE-2026-93518)\n * xorg-x11-server: xorg-x11-server: Arbitrary code execution via buffer overflow in input_constrain_cursor() (CVE-2026-93519)\n * xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling (CVE-2026-93520)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
"id": "ALSA-2026:85191",
"modified": "2026-10-20T09:09:45Z",
"published": "2026-10-19T00:00:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:85191"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-88812"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-93516"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-93517"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-93518"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-93519"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-93520"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-93521"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-93522"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-93523"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2545161"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2545164"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2545174"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2545177"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2545178"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2545246"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2545860"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2545887"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2545908"
},
{
"type": "ADVISORY",
"url": "https://errata.almalinux.org/10/ALSA-2026-85191.html"
}
],
"related": [
"CVE-2026-93516",
"CVE-2026-93521",
"CVE-2026-88812",
"CVE-2026-93523",
"CVE-2026-93522",
"CVE-2026-93517",
"CVE-2026-93518",
"CVE-2026-93519",
"CVE-2026-93520"
],
"summary": "Important: xorg-x11-server-Xwayland security update"
}
ALSA-2026:85193
Vulnerability from osv_almalinux – Published: 2026-10-19 00:00 – Updated: 2026-10-20 09:07 – Source website
VLAI
Summary
Important: xorg-x11-server-Xwayland security update
Details
Xwayland is an X server for running X clients under Wayland.
Security Fix(es):
- xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-93516)
- xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests (CVE-2026-93521)
- xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling (CVE-2026-88812)
- xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice (CVE-2026-93523)
- xorg-x11-server: glamor: size tmp_bits buffer for source coordinate range in upload_boxes (CVE-2026-93522)
- xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow (CVE-2026-93517)
- xorg-x11-server: xorg-x11-server: arbitrary code execution via integer truncation during keyboard mapping resize (CVE-2026-93518)
- xorg-x11-server: xorg-x11-server: Arbitrary code execution via buffer overflow in input_constrain_cursor() (CVE-2026-93519)
- xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling (CVE-2026-93520)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
| URL | Type | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"affected": [
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "xorg-x11-server-Xwayland"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "24.1.9-4.el9_8.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "xorg-x11-server-Xwayland-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "24.1.9-4.el9_8.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"details": "Xwayland is an X server for running X clients under Wayland. \n\nSecurity Fix(es): \n\n * xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-93516)\n * xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests (CVE-2026-93521)\n * xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling (CVE-2026-88812)\n * xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice (CVE-2026-93523)\n * xorg-x11-server: glamor: size tmp_bits buffer for source coordinate range in upload_boxes (CVE-2026-93522)\n * xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow (CVE-2026-93517)\n * xorg-x11-server: xorg-x11-server: arbitrary code execution via integer truncation during keyboard mapping resize (CVE-2026-93518)\n * xorg-x11-server: xorg-x11-server: Arbitrary code execution via buffer overflow in input_constrain_cursor() (CVE-2026-93519)\n * xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling (CVE-2026-93520)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
"id": "ALSA-2026:85193",
"modified": "2026-10-20T09:07:26Z",
"published": "2026-10-19T00:00:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:85193"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-88812"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-93516"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-93517"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-93518"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-93519"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-93520"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-93521"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-93522"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-93523"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2545161"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2545164"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2545174"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2545177"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2545178"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2545246"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2545860"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2545887"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2545908"
},
{
"type": "ADVISORY",
"url": "https://errata.almalinux.org/9/ALSA-2026-85193.html"
}
],
"related": [
"CVE-2026-93516",
"CVE-2026-93521",
"CVE-2026-88812",
"CVE-2026-93523",
"CVE-2026-93522",
"CVE-2026-93517",
"CVE-2026-93518",
"CVE-2026-93519",
"CVE-2026-93520"
],
"summary": "Important: xorg-x11-server-Xwayland security update"
}
BELL-CVE-2026-93522 (CVE-2026-93522)
Vulnerability from osv_bellsoft – Published: 2026-10-08 17:21 – Updated: 2026-10-12 23:42 – Source website
VLAI
References
| URL | Type | |
|---|---|---|
{
"affected": [
{
"package": {
"ecosystem": "Alpaquita:23",
"name": "xorg-server",
"purl": "pkg:apk/alpaquita/xorg-server?arch=source\u0026distro=23"
},
"ranges": [
{
"events": [
{
"introduced": "21.1.4-r1"
},
{
"fixed": "21.1.25-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Alpaquita:25",
"name": "xorg-server",
"purl": "pkg:apk/alpaquita/xorg-server?arch=source\u0026distro=25"
},
"ranges": [
{
"events": [
{
"introduced": "21.1.16-r0"
},
{
"fixed": "21.1.25-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Alpaquita:stream",
"name": "xorg-server",
"purl": "pkg:apk/alpaquita/xorg-server?arch=source\u0026distro=stream"
},
"ranges": [
{
"events": [
{
"introduced": "21.1.4-r1"
},
{
"fixed": "21.1.25-r0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"id": "BELL-CVE-2026-93522",
"modified": "2026-10-12T23:42:50.80782Z",
"published": "2026-10-08T17:21:32.694833Z",
"references": [
{
"type": "ADVISORY",
"url": "https://docs.bell-sw.com/security/cves/CVE-2026-93522"
}
],
"schema_version": "1.7.4",
"upstream": [
"CVE-2026-93522"
]
}
OPENSUSE-SU-2026:12105-1
Vulnerability from csaf_opensuse - Published: 2026-10-10 00:00 - Updated: 2026-10-11 11:56Summary
xwayland-24.1.13-2.1 on GA media
Severity
Moderate
Scope
12 vulnerabilities in this advisory, including CVE-2026-93522.
CVE-2026-93522
7.8 (High)
Recommended: 8 products
OPENSUSE-SU-2026:22085-1
Vulnerability from csaf_opensuse - Published: 2026-10-12 08:18 - Updated: 2026-10-19 17:25Summary
Security update for xwayland
Severity
Important
Scope
12 vulnerabilities in this advisory, including CVE-2026-93522.
CVE-2026-93522
7.8 (High)
Recommended: 8 products
RHSA-2026:85191
Vulnerability from csaf_opensuse - Published: 2026-10-19 00:00 - Updated: 2026-10-21 19:01Summary
security update for xorg-x11-server-Xwayland
Severity
Important
Scope
9 vulnerabilities in this advisory, including CVE-2026-93522.
CVE-2026-93522
7.8 (High)
Recommended: 2 products
RHSA-2026:85193
Vulnerability from csaf_opensuse - Published: 2026-10-19 00:00 - Updated: 2026-10-21 19:01Summary
security update for xorg-x11-server-Xwayland
Severity
Important
Scope
9 vulnerabilities in this advisory, including CVE-2026-93522.
CVE-2026-93522
7.8 (High)
Recommended: 4 products
RLSA-2026:85191 (CVE-2026-88812)
Vulnerability from osv_rocky – Published: 2026-10-20 12:10 – Updated: 2026-10-23 12:16 – Source website
VLAI
Summary
Important: xorg-x11-server-Xwayland security update
Details
Xwayland is an X server for running X clients under Wayland.
Security Fix(es):
-
xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-93516)
-
xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests (CVE-2026-93521)
-
xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling (CVE-2026-88812)
-
xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice (CVE-2026-93523)
-
xorg-x11-server: glamor: size tmp_bits buffer for source coordinate range in upload_boxes (CVE-2026-93522)
-
xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow (CVE-2026-93517)
-
xorg-x11-server: xorg-x11-server: arbitrary code execution via integer truncation during keyboard mapping resize (CVE-2026-93518)
-
xorg-x11-server: xorg-x11-server: Arbitrary code execution via buffer overflow in input_constrain_cursor() (CVE-2026-93519)
-
xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling (CVE-2026-93520)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Severity
7.8 (High)
References
| URL | Type | ||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||
{
"affected": [
{
"package": {
"ecosystem": "Rocky Linux:10",
"name": "xorg-x11-server-Xwayland",
"purl": "pkg:rpm/rocky-linux/xorg-x11-server-Xwayland?distro=rocky-linux-10\u0026epoch=0"
},
"ranges": [
{
"database_specific": {
"yum_repository": "AppStream"
},
"events": [
{
"introduced": "0"
},
{
"fixed": "0:24.1.9-4.el10_2.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"credits": [
{
"name": "Rocky Enterprise Software Foundation"
},
{
"name": "Red Hat"
}
],
"database_specific": {
"license": "CC-BY-4.0",
"license_url": "https://creativecommons.org/licenses/by/4.0/",
"source_advisory": "RHSA-2026:85191"
},
"details": "Xwayland is an X server for running X clients under Wayland.\n\nSecurity Fix(es):\n\n* xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-93516)\n\n* xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests (CVE-2026-93521)\n\n* xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling (CVE-2026-88812)\n\n* xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice (CVE-2026-93523)\n\n* xorg-x11-server: glamor: size tmp_bits buffer for source coordinate range in upload_boxes (CVE-2026-93522)\n\n* xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow (CVE-2026-93517)\n\n* xorg-x11-server: xorg-x11-server: arbitrary code execution via integer truncation during keyboard mapping resize (CVE-2026-93518)\n\n* xorg-x11-server: xorg-x11-server: Arbitrary code execution via buffer overflow in input_constrain_cursor() (CVE-2026-93519)\n\n* xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling (CVE-2026-93520)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"id": "RLSA-2026:85191",
"modified": "2026-10-23T12:16:18.445133Z",
"published": "2026-10-20T12:10:14.939262Z",
"references": [
{
"type": "ADVISORY",
"url": "https://errata.rockylinux.org/RLSA-2026:85191"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545161"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545164"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545174"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545177"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545178"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545246"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545860"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545887"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545908"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:85191"
}
],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Important: xorg-x11-server-Xwayland security update",
"upstream": [
"CVE-2026-88812",
"CVE-2026-93516",
"CVE-2026-93517",
"CVE-2026-93518",
"CVE-2026-93519",
"CVE-2026-93520",
"CVE-2026-93521",
"CVE-2026-93522",
"CVE-2026-93523"
]
}
RLSA-2026:85193 (CVE-2026-88812)
Vulnerability from osv_rocky – Published: 2026-10-20 12:05 – Updated: 2026-10-23 12:16 – Source website
VLAI
Summary
Important: xorg-x11-server-Xwayland security update
Details
Xwayland is an X server for running X clients under Wayland.
Security Fix(es):
-
xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-93516)
-
xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests (CVE-2026-93521)
-
xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling (CVE-2026-88812)
-
xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice (CVE-2026-93523)
-
xorg-x11-server: glamor: size tmp_bits buffer for source coordinate range in upload_boxes (CVE-2026-93522)
-
xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow (CVE-2026-93517)
-
xorg-x11-server: xorg-x11-server: arbitrary code execution via integer truncation during keyboard mapping resize (CVE-2026-93518)
-
xorg-x11-server: xorg-x11-server: Arbitrary code execution via buffer overflow in input_constrain_cursor() (CVE-2026-93519)
-
xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling (CVE-2026-93520)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Severity
7.8 (High)
References
| URL | Type | ||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||
{
"affected": [
{
"package": {
"ecosystem": "Rocky Linux:9",
"name": "xorg-x11-server-Xwayland",
"purl": "pkg:rpm/rocky-linux/xorg-x11-server-Xwayland?distro=rocky-linux-9\u0026epoch=0"
},
"ranges": [
{
"database_specific": {
"yum_repository": "AppStream"
},
"events": [
{
"introduced": "0"
},
{
"fixed": "0:24.1.9-4.el9_8.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"credits": [
{
"name": "Rocky Enterprise Software Foundation"
},
{
"name": "Red Hat"
}
],
"database_specific": {
"license": "CC-BY-4.0",
"license_url": "https://creativecommons.org/licenses/by/4.0/",
"source_advisory": "RHSA-2026:85193"
},
"details": "Xwayland is an X server for running X clients under Wayland.\n\nSecurity Fix(es):\n\n* xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-93516)\n\n* xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests (CVE-2026-93521)\n\n* xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling (CVE-2026-88812)\n\n* xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice (CVE-2026-93523)\n\n* xorg-x11-server: glamor: size tmp_bits buffer for source coordinate range in upload_boxes (CVE-2026-93522)\n\n* xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow (CVE-2026-93517)\n\n* xorg-x11-server: xorg-x11-server: arbitrary code execution via integer truncation during keyboard mapping resize (CVE-2026-93518)\n\n* xorg-x11-server: xorg-x11-server: Arbitrary code execution via buffer overflow in input_constrain_cursor() (CVE-2026-93519)\n\n* xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling (CVE-2026-93520)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"id": "RLSA-2026:85193",
"modified": "2026-10-23T12:16:13.017714Z",
"published": "2026-10-20T12:05:07.452289Z",
"references": [
{
"type": "ADVISORY",
"url": "https://errata.rockylinux.org/RLSA-2026:85193"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545161"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545164"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545174"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545177"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545178"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545246"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545860"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545887"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545908"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:85193"
}
],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Important: xorg-x11-server-Xwayland security update",
"upstream": [
"CVE-2026-88812",
"CVE-2026-93516",
"CVE-2026-93517",
"CVE-2026-93518",
"CVE-2026-93519",
"CVE-2026-93520",
"CVE-2026-93521",
"CVE-2026-93522",
"CVE-2026-93523"
]
}
SUSE-SU-2026:24230-1
Vulnerability from csaf_suse - Published: 2026-10-12 08:18 - Updated: 2026-10-21 11:50Summary
Security update for xwayland
Severity
Important
Scope
12 vulnerabilities in this advisory, including CVE-2026-93522.
CVE-2026-93522
7.8 (High)
Recommended: 16 products
UBUNTU-CVE-2026-93522 (CVE-2026-93522)
Vulnerability from osv_ubuntu – Published: 2026-10-07 00:00 – Updated: 2026-10-19 20:37 – Source website
VLAI
Details
[Glamor CopyArea CPU-FBO Heap Buffer Overflow]
Severity
N/A (UNKNOWN)
References
{
"affected": [
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "xdmx",
"binary_version": "2:1.15.1-0ubuntu2.11+esm12"
},
{
"binary_name": "xdmx-tools",
"binary_version": "2:1.15.1-0ubuntu2.11+esm12"
},
{
"binary_name": "xnest",
"binary_version": "2:1.15.1-0ubuntu2.11+esm12"
},
{
"binary_name": "xorg-server-source",
"binary_version": "2:1.15.1-0ubuntu2.11+esm12"
},
{
"binary_name": "xserver-common",
"binary_version": "2:1.15.1-0ubuntu2.11+esm12"
},
{
"binary_name": "xserver-xephyr",
"binary_version": "2:1.15.1-0ubuntu2.11+esm12"
},
{
"binary_name": "xserver-xorg-core",
"binary_version": "2:1.15.1-0ubuntu2.11+esm12"
},
{
"binary_name": "xserver-xorg-xmir",
"binary_version": "2:1.15.1-0ubuntu2.11+esm12"
},
{
"binary_name": "xvfb",
"binary_version": "2:1.15.1-0ubuntu2.11+esm12"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:14.04:LTS",
"name": "xorg-server",
"purl": "pkg:deb/ubuntu/xorg-server@2:1.15.1-0ubuntu2.11+esm12?arch=source\u0026distro=esm-infra-legacy/trusty"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2:1.14.3-3ubuntu2",
"2:1.14.3-3ubuntu3",
"2:1.14.3-3ubuntu4",
"2:1.14.3-5ubuntu1",
"2:1.14.4-1ubuntu1",
"2:1.14.4-1ubuntu2",
"2:1.14.4.901-0ubuntu2",
"2:1.14.5-1ubuntu2",
"2:1.14.5-1ubuntu4",
"2:1.15.0-1ubuntu1",
"2:1.15.0-1ubuntu2",
"2:1.15.0-1ubuntu3",
"2:1.15.0-1ubuntu4",
"2:1.15.0-1ubuntu6",
"2:1.15.0-1ubuntu7",
"2:1.15.1-0ubuntu1",
"2:1.15.1-0ubuntu2",
"2:1.15.1-0ubuntu2.1",
"2:1.15.1-0ubuntu2.4",
"2:1.15.1-0ubuntu2.5",
"2:1.15.1-0ubuntu2.6",
"2:1.15.1-0ubuntu2.7",
"2:1.15.1-0ubuntu2.9",
"2:1.15.1-0ubuntu2.10",
"2:1.15.1-0ubuntu2.11",
"2:1.15.1-0ubuntu2.11+esm2",
"2:1.15.1-0ubuntu2.11+esm3",
"2:1.15.1-0ubuntu2.11+esm4",
"2:1.15.1-0ubuntu2.11+esm5",
"2:1.15.1-0ubuntu2.11+esm6",
"2:1.15.1-0ubuntu2.11+esm7",
"2:1.15.1-0ubuntu2.11+esm8",
"2:1.15.1-0ubuntu2.11+esm9",
"2:1.15.1-0ubuntu2.11+esm11",
"2:1.15.1-0ubuntu2.11+esm12"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "xdmx",
"binary_version": "2:1.18.4-0ubuntu0.12+esm18"
},
{
"binary_name": "xdmx-tools",
"binary_version": "2:1.18.4-0ubuntu0.12+esm18"
},
{
"binary_name": "xmir",
"binary_version": "2:1.18.4-0ubuntu0.12+esm18"
},
{
"binary_name": "xnest",
"binary_version": "2:1.18.4-0ubuntu0.12+esm18"
},
{
"binary_name": "xorg-server-source",
"binary_version": "2:1.18.4-0ubuntu0.12+esm18"
},
{
"binary_name": "xserver-common",
"binary_version": "2:1.18.4-0ubuntu0.12+esm18"
},
{
"binary_name": "xserver-xephyr",
"binary_version": "2:1.18.4-0ubuntu0.12+esm18"
},
{
"binary_name": "xserver-xorg-core",
"binary_version": "2:1.18.4-0ubuntu0.12+esm18"
},
{
"binary_name": "xserver-xorg-legacy",
"binary_version": "2:1.18.4-0ubuntu0.12+esm18"
},
{
"binary_name": "xserver-xorg-xmir",
"binary_version": "2:1.18.4-0ubuntu0.12+esm18"
},
{
"binary_name": "xvfb",
"binary_version": "2:1.18.4-0ubuntu0.12+esm18"
},
{
"binary_name": "xwayland",
"binary_version": "2:1.18.4-0ubuntu0.12+esm18"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:16.04:LTS",
"name": "xorg-server",
"purl": "pkg:deb/ubuntu/xorg-server@2:1.18.4-0ubuntu0.12+esm18?arch=source\u0026distro=esm-infra/xenial"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2:1.17.2-1ubuntu9",
"2:1.17.2-1ubuntu10",
"2:1.17.3-2ubuntu1",
"2:1.17.3-2ubuntu2",
"2:1.17.3-2ubuntu3",
"2:1.17.3-2ubuntu4",
"2:1.18.1-1ubuntu3",
"2:1.18.1-1ubuntu4",
"2:1.18.3-1ubuntu1",
"2:1.18.3-1ubuntu2",
"2:1.18.3-1ubuntu2.2",
"2:1.18.3-1ubuntu2.3",
"2:1.18.4-0ubuntu0.1",
"2:1.18.4-0ubuntu0.2",
"2:1.18.4-0ubuntu0.3",
"2:1.18.4-0ubuntu0.4",
"2:1.18.4-0ubuntu0.6",
"2:1.18.4-0ubuntu0.7",
"2:1.18.4-0ubuntu0.8",
"2:1.18.4-0ubuntu0.9",
"2:1.18.4-0ubuntu0.10",
"2:1.18.4-0ubuntu0.11",
"2:1.18.4-0ubuntu0.12",
"2:1.18.4-0ubuntu0.12+esm1",
"2:1.18.4-0ubuntu0.12+esm2",
"2:1.18.4-0ubuntu0.12+esm4",
"2:1.18.4-0ubuntu0.12+esm5",
"2:1.18.4-0ubuntu0.12+esm6",
"2:1.18.4-0ubuntu0.12+esm8",
"2:1.18.4-0ubuntu0.12+esm9",
"2:1.18.4-0ubuntu0.12+esm10",
"2:1.18.4-0ubuntu0.12+esm12",
"2:1.18.4-0ubuntu0.12+esm13",
"2:1.18.4-0ubuntu0.12+esm14",
"2:1.18.4-0ubuntu0.12+esm15",
"2:1.18.4-0ubuntu0.12+esm16",
"2:1.18.4-0ubuntu0.12+esm17",
"2:1.18.4-0ubuntu0.12+esm18"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "xmir-hwe-16.04",
"binary_version": "2:1.19.6-1ubuntu4.1~16.04.6+esm10"
},
{
"binary_name": "xorg-server-source-hwe-16.04",
"binary_version": "2:1.19.6-1ubuntu4.1~16.04.6+esm10"
},
{
"binary_name": "xserver-xephyr-hwe-16.04",
"binary_version": "2:1.19.6-1ubuntu4.1~16.04.6+esm10"
},
{
"binary_name": "xserver-xorg-core-hwe-16.04",
"binary_version": "2:1.19.6-1ubuntu4.1~16.04.6+esm10"
},
{
"binary_name": "xserver-xorg-dev-hwe-16.04",
"binary_version": "2:1.19.6-1ubuntu4.1~16.04.6+esm10"
},
{
"binary_name": "xserver-xorg-legacy-hwe-16.04",
"binary_version": "2:1.19.6-1ubuntu4.1~16.04.6+esm10"
},
{
"binary_name": "xwayland-hwe-16.04",
"binary_version": "2:1.19.6-1ubuntu4.1~16.04.6+esm10"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:16.04:LTS",
"name": "xorg-server-hwe-16.04",
"purl": "pkg:deb/ubuntu/xorg-server-hwe-16.04@2:1.19.6-1ubuntu4.1~16.04.6+esm10?arch=source\u0026distro=esm-infra/xenial"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2:1.18.4-1ubuntu6.1~16.04.1",
"2:1.18.4-1ubuntu6.1~16.04.2",
"2:1.19.3-1ubuntu1~16.04.2",
"2:1.19.3-1ubuntu1~16.04.3",
"2:1.19.3-1ubuntu1~16.04.4",
"2:1.19.5-0ubuntu2~16.04.1",
"2:1.19.6-1ubuntu4~16.04.1",
"2:1.19.6-1ubuntu4.1~16.04.1",
"2:1.19.6-1ubuntu4.1~16.04.2",
"2:1.19.6-1ubuntu4.1~16.04.3",
"2:1.19.6-1ubuntu4.1~16.04.4",
"2:1.19.6-1ubuntu4.1~16.04.5",
"2:1.19.6-1ubuntu4.1~16.04.6",
"2:1.19.6-1ubuntu4.1~16.04.6+esm1",
"2:1.19.6-1ubuntu4.1~16.04.6+esm3",
"2:1.19.6-1ubuntu4.1~16.04.6+esm4",
"2:1.19.6-1ubuntu4.1~16.04.6+esm5",
"2:1.19.6-1ubuntu4.1~16.04.6+esm6",
"2:1.19.6-1ubuntu4.1~16.04.6+esm7",
"2:1.19.6-1ubuntu4.1~16.04.6+esm8",
"2:1.19.6-1ubuntu4.1~16.04.6+esm9",
"2:1.19.6-1ubuntu4.1~16.04.6+esm10"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "xdmx",
"binary_version": "2:1.19.6-1ubuntu4.15+esm13"
},
{
"binary_name": "xdmx-tools",
"binary_version": "2:1.19.6-1ubuntu4.15+esm13"
},
{
"binary_name": "xmir",
"binary_version": "2:1.19.6-1ubuntu4.15+esm13"
},
{
"binary_name": "xnest",
"binary_version": "2:1.19.6-1ubuntu4.15+esm13"
},
{
"binary_name": "xorg-server-source",
"binary_version": "2:1.19.6-1ubuntu4.15+esm13"
},
{
"binary_name": "xserver-common",
"binary_version": "2:1.19.6-1ubuntu4.15+esm13"
},
{
"binary_name": "xserver-xephyr",
"binary_version": "2:1.19.6-1ubuntu4.15+esm13"
},
{
"binary_name": "xserver-xorg-core",
"binary_version": "2:1.19.6-1ubuntu4.15+esm13"
},
{
"binary_name": "xserver-xorg-legacy",
"binary_version": "2:1.19.6-1ubuntu4.15+esm13"
},
{
"binary_name": "xserver-xorg-xmir",
"binary_version": "2:1.19.6-1ubuntu4.15+esm13"
},
{
"binary_name": "xvfb",
"binary_version": "2:1.19.6-1ubuntu4.15+esm13"
},
{
"binary_name": "xwayland",
"binary_version": "2:1.19.6-1ubuntu4.15+esm13"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:18.04:LTS",
"name": "xorg-server",
"purl": "pkg:deb/ubuntu/xorg-server@2:1.19.6-1ubuntu4.15+esm13?arch=source\u0026distro=esm-infra/bionic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2:1.19.5-0ubuntu2",
"2:1.19.6-1ubuntu1",
"2:1.19.6-1ubuntu2",
"2:1.19.6-1ubuntu3",
"2:1.19.6-1ubuntu4",
"2:1.19.6-1ubuntu4.1",
"2:1.19.6-1ubuntu4.2",
"2:1.19.6-1ubuntu4.3",
"2:1.19.6-1ubuntu4.4",
"2:1.19.6-1ubuntu4.5",
"2:1.19.6-1ubuntu4.6",
"2:1.19.6-1ubuntu4.7",
"2:1.19.6-1ubuntu4.8",
"2:1.19.6-1ubuntu4.9",
"2:1.19.6-1ubuntu4.10",
"2:1.19.6-1ubuntu4.11",
"2:1.19.6-1ubuntu4.12",
"2:1.19.6-1ubuntu4.13",
"2:1.19.6-1ubuntu4.14",
"2:1.19.6-1ubuntu4.15",
"2:1.19.6-1ubuntu4.15+esm1",
"2:1.19.6-1ubuntu4.15+esm3",
"2:1.19.6-1ubuntu4.15+esm4",
"2:1.19.6-1ubuntu4.15+esm5",
"2:1.19.6-1ubuntu4.15+esm7",
"2:1.19.6-1ubuntu4.15+esm8",
"2:1.19.6-1ubuntu4.15+esm9",
"2:1.19.6-1ubuntu4.15+esm10",
"2:1.19.6-1ubuntu4.15+esm11",
"2:1.19.6-1ubuntu4.15+esm12",
"2:1.19.6-1ubuntu4.15+esm13"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "xorg-server-source-hwe-18.04",
"binary_version": "2:1.20.8-2ubuntu2.2~18.04.11+esm5"
},
{
"binary_name": "xserver-xephyr-hwe-18.04",
"binary_version": "2:1.20.8-2ubuntu2.2~18.04.11+esm5"
},
{
"binary_name": "xserver-xorg-core-hwe-18.04",
"binary_version": "2:1.20.8-2ubuntu2.2~18.04.11+esm5"
},
{
"binary_name": "xserver-xorg-dev-hwe-18.04",
"binary_version": "2:1.20.8-2ubuntu2.2~18.04.11+esm5"
},
{
"binary_name": "xserver-xorg-legacy-hwe-18.04",
"binary_version": "2:1.20.8-2ubuntu2.2~18.04.11+esm5"
},
{
"binary_name": "xwayland-hwe-18.04",
"binary_version": "2:1.20.8-2ubuntu2.2~18.04.11+esm5"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:18.04:LTS",
"name": "xorg-server-hwe-18.04",
"purl": "pkg:deb/ubuntu/xorg-server-hwe-18.04@2:1.20.8-2ubuntu2.2~18.04.11+esm5?arch=source\u0026distro=esm-infra/bionic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2:1.20.1-3ubuntu2.1~18.04.1",
"2:1.20.4-1ubuntu3~18.04.1",
"2:1.20.5+git20191008-0ubuntu1~18.04.1",
"2:1.20.8-2ubuntu2.1~18.04.1",
"2:1.20.8-2ubuntu2.2~18.04.1",
"2:1.20.8-2ubuntu2.2~18.04.2",
"2:1.20.8-2ubuntu2.2~18.04.3",
"2:1.20.8-2ubuntu2.2~18.04.4",
"2:1.20.8-2ubuntu2.2~18.04.5",
"2:1.20.8-2ubuntu2.2~18.04.6",
"2:1.20.8-2ubuntu2.2~18.04.7",
"2:1.20.8-2ubuntu2.2~18.04.8",
"2:1.20.8-2ubuntu2.2~18.04.9",
"2:1.20.8-2ubuntu2.2~18.04.10",
"2:1.20.8-2ubuntu2.2~18.04.11",
"2:1.20.8-2ubuntu2.2~18.04.11+esm1",
"2:1.20.8-2ubuntu2.2~18.04.11+esm2",
"2:1.20.8-2ubuntu2.2~18.04.11+esm3",
"2:1.20.8-2ubuntu2.2~18.04.11+esm4",
"2:1.20.8-2ubuntu2.2~18.04.11+esm5"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "xdmx",
"binary_version": "2:1.20.13-1ubuntu1~20.04.20+esm1"
},
{
"binary_name": "xdmx-tools",
"binary_version": "2:1.20.13-1ubuntu1~20.04.20+esm1"
},
{
"binary_name": "xnest",
"binary_version": "2:1.20.13-1ubuntu1~20.04.20+esm1"
},
{
"binary_name": "xorg-server-source",
"binary_version": "2:1.20.13-1ubuntu1~20.04.20+esm1"
},
{
"binary_name": "xserver-common",
"binary_version": "2:1.20.13-1ubuntu1~20.04.20+esm1"
},
{
"binary_name": "xserver-xephyr",
"binary_version": "2:1.20.13-1ubuntu1~20.04.20+esm1"
},
{
"binary_name": "xserver-xorg-core",
"binary_version": "2:1.20.13-1ubuntu1~20.04.20+esm1"
},
{
"binary_name": "xserver-xorg-legacy",
"binary_version": "2:1.20.13-1ubuntu1~20.04.20+esm1"
},
{
"binary_name": "xvfb",
"binary_version": "2:1.20.13-1ubuntu1~20.04.20+esm1"
},
{
"binary_name": "xwayland",
"binary_version": "2:1.20.13-1ubuntu1~20.04.20+esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:20.04:LTS",
"name": "xorg-server",
"purl": "pkg:deb/ubuntu/xorg-server@2:1.20.13-1ubuntu1~20.04.20+esm1?arch=source\u0026distro=esm-infra/focal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2:1.20.5+git20191008-0ubuntu1",
"2:1.20.6-1ubuntu1",
"2:1.20.7-2ubuntu1",
"2:1.20.7-2ubuntu2",
"2:1.20.8-2ubuntu2",
"2:1.20.8-2ubuntu2.1",
"2:1.20.8-2ubuntu2.2",
"2:1.20.8-2ubuntu2.3",
"2:1.20.8-2ubuntu2.4",
"2:1.20.8-2ubuntu2.6",
"2:1.20.9-2ubuntu1.1~20.04.1",
"2:1.20.9-2ubuntu1.2~20.04.1",
"2:1.20.9-2ubuntu1.2~20.04.2",
"2:1.20.11-1ubuntu1~20.04.2",
"2:1.20.13-1ubuntu1~20.04.2",
"2:1.20.13-1ubuntu1~20.04.3",
"2:1.20.13-1ubuntu1~20.04.4",
"2:1.20.13-1ubuntu1~20.04.5",
"2:1.20.13-1ubuntu1~20.04.6",
"2:1.20.13-1ubuntu1~20.04.8",
"2:1.20.13-1ubuntu1~20.04.9",
"2:1.20.13-1ubuntu1~20.04.12",
"2:1.20.13-1ubuntu1~20.04.14",
"2:1.20.13-1ubuntu1~20.04.15",
"2:1.20.13-1ubuntu1~20.04.16",
"2:1.20.13-1ubuntu1~20.04.17",
"2:1.20.13-1ubuntu1~20.04.18",
"2:1.20.13-1ubuntu1~20.04.19",
"2:1.20.13-1ubuntu1~20.04.20",
"2:1.20.13-1ubuntu1~20.04.20+esm1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "xnest",
"binary_version": "2:21.1.4-2ubuntu1.7~22.04.16"
},
{
"binary_name": "xorg-server-source",
"binary_version": "2:21.1.4-2ubuntu1.7~22.04.16"
},
{
"binary_name": "xserver-common",
"binary_version": "2:21.1.4-2ubuntu1.7~22.04.16"
},
{
"binary_name": "xserver-xephyr",
"binary_version": "2:21.1.4-2ubuntu1.7~22.04.16"
},
{
"binary_name": "xserver-xorg-core",
"binary_version": "2:21.1.4-2ubuntu1.7~22.04.16"
},
{
"binary_name": "xserver-xorg-legacy",
"binary_version": "2:21.1.4-2ubuntu1.7~22.04.16"
},
{
"binary_name": "xvfb",
"binary_version": "2:21.1.4-2ubuntu1.7~22.04.16"
}
]
},
"package": {
"ecosystem": "Ubuntu:22.04:LTS",
"name": "xorg-server",
"purl": "pkg:deb/ubuntu/xorg-server@2:21.1.4-2ubuntu1.7~22.04.16?arch=source\u0026distro=jammy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2:1.20.13-1ubuntu1",
"2:1.20.13-1ubuntu2",
"2:1.20.14-1ubuntu1",
"2:21.1.3-2ubuntu2",
"2:21.1.3-2ubuntu2.1",
"2:21.1.3-2ubuntu2.2",
"2:21.1.3-2ubuntu2.3",
"2:21.1.3-2ubuntu2.4",
"2:21.1.3-2ubuntu2.5",
"2:21.1.3-2ubuntu2.6",
"2:21.1.3-2ubuntu2.7",
"2:21.1.3-2ubuntu2.8",
"2:21.1.3-2ubuntu2.9",
"2:21.1.4-2ubuntu1.7~22.04.1",
"2:21.1.4-2ubuntu1.7~22.04.2",
"2:21.1.4-2ubuntu1.7~22.04.5",
"2:21.1.4-2ubuntu1.7~22.04.7",
"2:21.1.4-2ubuntu1.7~22.04.8",
"2:21.1.4-2ubuntu1.7~22.04.9",
"2:21.1.4-2ubuntu1.7~22.04.10",
"2:21.1.4-2ubuntu1.7~22.04.11",
"2:21.1.4-2ubuntu1.7~22.04.12",
"2:21.1.4-2ubuntu1.7~22.04.13",
"2:21.1.4-2ubuntu1.7~22.04.14",
"2:21.1.4-2ubuntu1.7~22.04.15",
"2:21.1.4-2ubuntu1.7~22.04.16"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "xwayland",
"binary_version": "2:22.1.1-1ubuntu0.20"
}
]
},
"package": {
"ecosystem": "Ubuntu:22.04:LTS",
"name": "xwayland",
"purl": "pkg:deb/ubuntu/xwayland@2:22.1.1-1ubuntu0.20?arch=source\u0026distro=jammy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2:21.1.2-0ubuntu1",
"2:21.1.3-1",
"2:21.1.3-1ubuntu1",
"2:21.1.4-1",
"2:22.1.0-1",
"2:22.1.1-1",
"2:22.1.1-1ubuntu0.1",
"2:22.1.1-1ubuntu0.2",
"2:22.1.1-1ubuntu0.3",
"2:22.1.1-1ubuntu0.4",
"2:22.1.1-1ubuntu0.5",
"2:22.1.1-1ubuntu0.6",
"2:22.1.1-1ubuntu0.7",
"2:22.1.1-1ubuntu0.9",
"2:22.1.1-1ubuntu0.10",
"2:22.1.1-1ubuntu0.11",
"2:22.1.1-1ubuntu0.12",
"2:22.1.1-1ubuntu0.13",
"2:22.1.1-1ubuntu0.14",
"2:22.1.1-1ubuntu0.15",
"2:22.1.1-1ubuntu0.17",
"2:22.1.1-1ubuntu0.18",
"2:22.1.1-1ubuntu0.19",
"2:22.1.1-1ubuntu0.20"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "xnest",
"binary_version": "2:21.1.12-1ubuntu1.9"
},
{
"binary_name": "xorg-server-source",
"binary_version": "2:21.1.12-1ubuntu1.9"
},
{
"binary_name": "xserver-common",
"binary_version": "2:21.1.12-1ubuntu1.9"
},
{
"binary_name": "xserver-xephyr",
"binary_version": "2:21.1.12-1ubuntu1.9"
},
{
"binary_name": "xserver-xorg-core",
"binary_version": "2:21.1.12-1ubuntu1.9"
},
{
"binary_name": "xserver-xorg-legacy",
"binary_version": "2:21.1.12-1ubuntu1.9"
},
{
"binary_name": "xvfb",
"binary_version": "2:21.1.12-1ubuntu1.9"
}
]
},
"package": {
"ecosystem": "Ubuntu:24.04:LTS",
"name": "xorg-server",
"purl": "pkg:deb/ubuntu/xorg-server@2:21.1.12-1ubuntu1.9?arch=source\u0026distro=noble"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2:21.1.7-3ubuntu2",
"2:21.1.7-3ubuntu2.1",
"2:21.1.10-1ubuntu1",
"2:21.1.11-2ubuntu1",
"2:21.1.12-1ubuntu1",
"2:21.1.12-1ubuntu1.1",
"2:21.1.12-1ubuntu1.2",
"2:21.1.12-1ubuntu1.3",
"2:21.1.12-1ubuntu1.4",
"2:21.1.12-1ubuntu1.5",
"2:21.1.12-1ubuntu1.6",
"2:21.1.12-1ubuntu1.8",
"2:21.1.12-1ubuntu1.9"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "xwayland",
"binary_version": "2:23.2.6-1ubuntu0.8"
}
]
},
"package": {
"ecosystem": "Ubuntu:24.04:LTS",
"name": "xwayland",
"purl": "pkg:deb/ubuntu/xwayland@2:23.2.6-1ubuntu0.8?arch=source\u0026distro=noble"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2:23.2.0-1",
"2:23.2.0-1ubuntu0.1",
"2:23.2.3-1",
"2:23.2.4-1",
"2:23.2.4-1build1",
"2:23.2.4-1build2",
"2:23.2.4-1build3",
"2:23.2.6-1",
"2:23.2.6-1ubuntu0.1",
"2:23.2.6-1ubuntu0.2",
"2:23.2.6-1ubuntu0.4",
"2:23.2.6-1ubuntu0.5",
"2:23.2.6-1ubuntu0.6",
"2:23.2.6-1ubuntu0.7",
"2:23.2.6-1ubuntu0.8"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "xnest",
"binary_version": "2:21.1.24-1ubuntu1"
},
{
"binary_name": "xorg-server-source",
"binary_version": "2:21.1.24-1ubuntu1"
},
{
"binary_name": "xserver-common",
"binary_version": "2:21.1.24-1ubuntu1"
},
{
"binary_name": "xserver-xephyr",
"binary_version": "2:21.1.24-1ubuntu1"
},
{
"binary_name": "xserver-xorg-core",
"binary_version": "2:21.1.24-1ubuntu1"
},
{
"binary_name": "xserver-xorg-legacy",
"binary_version": "2:21.1.24-1ubuntu1"
},
{
"binary_name": "xvfb",
"binary_version": "2:21.1.24-1ubuntu1"
}
]
},
"package": {
"ecosystem": "Ubuntu:26.10",
"name": "xorg-server",
"purl": "pkg:deb/ubuntu/xorg-server@2:21.1.24-1ubuntu1?arch=source\u0026distro=stonking"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2:21.1.22-1ubuntu1",
"2:21.1.22-1ubuntu4",
"2:21.1.24-1ubuntu1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "xwayland",
"binary_version": "2:24.1.14-1"
}
]
},
"package": {
"ecosystem": "Ubuntu:26.10",
"name": "xwayland",
"purl": "pkg:deb/ubuntu/xwayland@2:24.1.14-1?arch=source\u0026distro=stonking"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2:24.1.10-1",
"2:24.1.12-1",
"2:24.1.13-1",
"2:24.1.14-1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "xnest",
"binary_version": "2:21.1.22-1ubuntu1.3"
},
{
"binary_name": "xorg-server-source",
"binary_version": "2:21.1.22-1ubuntu1.3"
},
{
"binary_name": "xserver-common",
"binary_version": "2:21.1.22-1ubuntu1.3"
},
{
"binary_name": "xserver-xephyr",
"binary_version": "2:21.1.22-1ubuntu1.3"
},
{
"binary_name": "xserver-xorg-core",
"binary_version": "2:21.1.22-1ubuntu1.3"
},
{
"binary_name": "xserver-xorg-legacy",
"binary_version": "2:21.1.22-1ubuntu1.3"
},
{
"binary_name": "xvfb",
"binary_version": "2:21.1.22-1ubuntu1.3"
}
]
},
"package": {
"ecosystem": "Ubuntu:26.04:LTS",
"name": "xorg-server",
"purl": "pkg:deb/ubuntu/xorg-server@2:21.1.22-1ubuntu1.3?arch=source\u0026distro=resolute"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2:21.1.18-1ubuntu1",
"2:21.1.21-1ubuntu1",
"2:21.1.22-1ubuntu1",
"2:21.1.22-1ubuntu1.2",
"2:21.1.22-1ubuntu1.3"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "xwayland",
"binary_version": "2:24.1.10-1"
}
]
},
"package": {
"ecosystem": "Ubuntu:26.04:LTS",
"name": "xwayland",
"purl": "pkg:deb/ubuntu/xwayland@2:24.1.10-1?arch=source\u0026distro=resolute"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2:24.1.6-1ubuntu1",
"2:24.1.8-1",
"2:24.1.9-1",
"2:24.1.10-1"
]
}
],
"aliases": [],
"details": "[Glamor CopyArea CPU-FBO Heap Buffer Overflow]",
"id": "UBUNTU-CVE-2026-93522",
"modified": "2026-10-19T20:37:08Z",
"published": "2026-10-07T00:00:00Z",
"references": [
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2026-93522"
},
{
"type": "REPORT",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93522"
},
{
"type": "REPORT",
"url": "https://lists.x.org/archives/xorg-announce/2026-October/003747.html"
}
],
"related": [],
"schema_version": "1.7.0",
"severity": [
{
"score": "medium",
"type": "Ubuntu"
}
],
"upstream": [
"CVE-2026-93522"
]
}