X.Org patches eight server vulnerabilities a month after fixing 12 others
X.Org has fixed eight vulnerabilities in the X.Org X server and Xwayland, including one in the Xorg server that lets a malicious monitor corrupt its memory.
X.Org has fixed eight vulnerabilities in the X.Org X server and Xwayland, including one in the Xorg server that lets a malicious monitor corrupt its memory.
The fixes ship in xorg-server 21.1.26 and xwayland 24.1.15, and each of the eight affects versions before those two releases; the X server provides the low-level display layer for graphical desktops on many Linux and Unix systems.
Xwayland runs X11 applications on desktops built on Wayland, the newer display protocol, so Wayland users who run X11 applications are exposed too.
CVE-2026-109096 and CVE-2026-109903 both start from a negative image size: one lets a request with no image data pass the length check, and the other reports the bogus size to the client, which may then allocate or use a buffer of the wrong size.
The flaws can crash the server, corrupt its memory, or make it read or write outside the memory it should touch, and one can leak memory contents.
The Xorg server copies a monitor’s display-range entries into fixed-size arrays without checking the count against the arrays’ limits.
Feed it more entries than the arrays hold, from a rigged monitor or a crafted EDID, and the excess spills into neighboring data, which can crash the server or corrupt memory.
X.Org published no severity ratings or CVSS scores and did not say whether any of the eight could lead to code execution.
CVE-2026-109091 sits in the code that reads EDID, the block of data a monitor sends to describe the resolutions and refresh rates it supports.
In CVE-2026-109092, a negative size from the server’s hardware-specific code plus a crafted offset wraps XvShmPutImage’s bounds check, letting the server read or write outside a shared memory segment.
CVE-2026-109095, in the glamor acceleration code, computes image sizes with 32-bit integers that wrap to small values for large images, so the server reads past the data the client sent.
The server copies input values into a fixed-size stack array before checking that they fit.
On 32-bit servers, a large count wraps so a short request passes the length check, and the server reads or walks past the end of the request buffer.
An attacker going after this flaw needs a malicious monitor, or a doctored EDID, in front of the server, and anyone who installed that update in October has another one to install now.
What happened
X.Org has fixed eight vulnerabilities in the X.Org X server and Xwayland, including one in the Xorg server that lets a malicious monitor corrupt its memory.
The fixes ship in xorg-server 21.1.26 and xwayland 24.1.15, and each of the eight affects versions before those two releases; the X server provides the low-level display layer for graphical desktops on many Linux and Unix systems.
What changed
Xwayland runs X11 applications on desktops built on Wayland, the newer display protocol, so Wayland users who run X11 applications are exposed too.
CVE-2026-109096 and CVE-2026-109903 both start from a negative image size: one lets a request with no image data pass the length check, and the other reports the bogus size to the client, which may then allocate or use a buffer of the wrong size.
Who is affected
The flaws can crash the server, corrupt its memory, or make it read or write outside the memory it should touch, and one can leak memory contents.
The Xorg server copies a monitor’s display-range entries into fixed-size arrays without checking the count against the arrays’ limits.
Why it matters
Feed it more entries than the arrays hold, from a rigged monitor or a crafted EDID, and the excess spills into neighboring data, which can crash the server or corrupt memory.
X.Org published no severity ratings or CVSS scores and did not say whether any of the eight could lead to code execution.
Technical details
CVE-2026-109091 sits in the code that reads EDID, the block of data a monitor sends to describe the resolutions and refresh rates it supports.
In CVE-2026-109092, a negative size from the server’s hardware-specific code plus a crafted offset wraps XvShmPutImage’s bounds check, letting the server read or write outside a shared memory segment.
CVE-2026-109095, in the glamor acceleration code, computes image sizes with 32-bit integers that wrap to small values for large images, so the server reads past the data the client sent.
Response
The server copies input values into a fixed-size stack array before checking that they fit.
On 32-bit servers, a large count wraps so a short request passes the length check, and the server reads or walks past the end of the request buffer.
What remains unknown
X.Org published no severity ratings or CVSS scores and did not say whether any of the eight could lead to code execution.
What to watch next
Watch for revised vendor guidance, fixed versions and mitigation updates.