CVE Feed

    Dashboard / CVE / CVE-2026-93517

    CVE-2026-93517

    A heap buffer overflow in handling GLX RenderLarge request where dataBytes exceeds cmdlen in X.org X server before 21.1.25 and XWayland before 24.1.14 that could be be triggered by an authenticated X client could cause crashes or code execution in X server context.

    Published:Oct 7, 2026
    Last Modified:Oct 28, 2026
    EPS:Oct 28, 2026
    EPSS Score:
    CVSS Score:7.8

    Affected Products

    Vendor
    X.org
    Product
    X Server
    Vendor
    X.org
    Product
    Xwayland
    Vendor
    X.orgg
    Product
    Xorg-x11-server

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-93524 (CVSS 6.9) — A buffer overread in CheckKeySyms() in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used…
    CVE-2026-93516 (CVSS 5.5) — A use-after-free caused by lack of lifecycle management when adding / removing XInput master devices in X.org …
    CVE-2026-93536 (CVSS 5.3) — A use after free caused by missing lifecycle management of gesture sprites in GestureBuildSprite() in X.Org X …
    CVE-2026-93515 (CVSS 6.8) — A use-after-free in present_clear_window_notifies() in the X.org X Server before 21.1.25 and X Wayland before…
    CVE-2026-93523 (CVSS 7.8) — A heap buffer overflow caused by a XIPassiveUngrabDevice request with an out-of-range modifier value in X.Org …
    CVE-2026-50261 (CVSS 7.8) — A use-after-free flaw was found in the X.Org X server and Xwayland in SyncChangeCounter(). A client that sets …
    CVE-2026-50260 (CVSS 7.8) — A use-after-free flaw was found in the X.Org X server and Xwayland in FreeCounter(). A client that sets up mul…
    CVE-2026-50259 (CVSS 7.8) — A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. _XkbSetMapChecks() declares a…
    CVE-2026-50262 (CVSS 5.5) — An out-of-bounds read flaw was found in the X.Org X server and Xwayland in __glXDisp_ChangeDrawableAttributes(…
    CVE-2026-50264 (CVSS 7.8) — An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuffersWithFor…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High