# Eight X.Org Server and XWayland security flaws disclosed, fixed in 21.1.26 and 24.1.15

> **Key takeaway:** Eight new memory-safety vulnerabilities in the X.Org Server, discovered with AI assistance, also affect XWayland and are patched in xorg-server-21.1.26 and xwayland-24.1.15.

**Published:** 2026-11-10T13:55:33+00:00 
**Source:** Phoronix Benchmarks & Drivers 
**Category:** kernel-os 
**Canonical URL:** https://fosswire.org/news/eight-xorg-server-and-xwayland-security-flaws-disclosed-fixe.html 

## Summary
Security researchers, aided by AI and large language models, have disclosed eight additional vulnerabilities in the X.Org Server codebase, all of which also affect XWayland. The flaws span multiple subsystems including EDID parsing, shared-memory image handling, XTest input simulation, XRes resource queries, and glamor/Xv video acceleration. These add to an already extensive catalog of security issues in the X.Org Server revealed over the past decade.

The disclosed CVEs include out-of-bounds writes, bounds overflows, integer overflows, and negative-size bypasses that could enable local privilege escalation or denial of service. Fixes are available in xorg-server-21.1.26 and xwayland-24.1.15. Linux distributions and users running X11 or XWayland should prioritize updating to these versions.

## Vulnerability breakdown and affected subsystems
- **EDID parsing (CVE-2026-109091):** Out-of-bounds write in Display Descriptor Range (DS_RANGES) processing during EDID parsing, exploitable through malformed monitor metadata.
- **Shared-memory video (CVE-2026-109092):** Bounds overflow in XvShmPutImage shared-memory image transfer, allowing memory corruption via crafted image dimensions.
- **XTest input simulation (CVE-2026-109093):** Stack out-of-bounds write in XTestFakeInput valuator handling, potentially enabling privilege escalation through synthetic input events.
- **XRes resource extension (CVE-2026-109904, CVE-2026-109094):** Request size overflow in QueryClientIds and swap-path size overflow in QueryResourceBytes, both leading to memory corruption in the XRes extension.
- **glamor/Xv acceleration (CVE-2026-109095, CVE-2026-109096):** Integer overflow in glamor Xv image size calculation and negative image size length bypass in XvPutImage, affecting hardware-accelerated video presentation.
- **Xv query interface (CVE-2026-109903):** Negative size reply vulnerability in XvQueryImageAttributes, permitting information disclosure or memory corruption.

## Why it matters
These vulnerabilities affect every Linux distribution and BSD system still shipping X11 or relying on XWayland for legacy application compatibility, including Steam Deck and other gaming-focused platforms where XWayland remains critical for non-native Wayland titles. The continued stream of memory-safety flaws in the X.Org Server, now accelerated by AI-assisted discovery, reinforces pressure on distributions to complete Wayland transitions and to consider memory-safe reimplementations or hardening for remaining X11 compatibility layers.