CVE Feed

    Dashboard / CVE / CVE-2026-93536

    CVE-2026-93536

    A use after free caused by missing lifecycle management of gesture sprites in GestureBuildSprite() in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash the X server or potentially execute code.

    Published:Oct 7, 2026
    Last Modified:Oct 28, 2026
    EPS:Oct 28, 2026
    EPSS Score:
    CVSS Score:5.3

    Affected Products

    Vendor
    X.org
    Product
    X Server
    Vendor
    X.org
    Product
    Xorg-x11-server
    Vendor
    X.org
    Product
    Xwayland

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-92 Forced Integer Overflow

    Related CVEs

    CVE-2026-93523 (CVSS 7.8) — A heap buffer overflow caused by a XIPassiveUngrabDevice request with an out-of-range modifier value in X.Org …
    CVE-2026-93517 (CVSS 8.5) — A heap buffer overflow in handling GLX RenderLarge request where dataBytes exceeds cmdlen in X.org X server be…
    CVE-2026-93524 (CVSS 6.9) — A buffer overread in CheckKeySyms() in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used…
    CVE-2026-93516 (CVSS 5.5) — A use-after-free caused by lack of lifecycle management when adding / removing XInput master devices in X.org …
    CVE-2026-93515 (CVSS 6.8) — A use-after-free in present_clear_window_notifies() in the X.org X Server before 21.1.25 and X Wayland before…
    CVE-2026-50257 (CVSS 7.8) — A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence(). A client that sets…
    CVE-2026-50264 (CVSS 7.8) — An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuffersWithFor…
    CVE-2026-50263 (CVSS 5.5) — A use-after-free flaw was found in the X.Org X server and Xwayland in CreateSaverWindow(). A client can trigge…
    CVE-2026-50260 (CVSS 7.8) — A use-after-free flaw was found in the X.Org X server and Xwayland in FreeCounter(). A client that sets up mul…
    CVE-2026-50261 (CVSS 7.8) — A use-after-free flaw was found in the X.Org X server and Xwayland in SyncChangeCounter(). A client that sets …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High