Help Net Security reports X.Org fixes eight X server and Xwayland flaws

What happened

According to Help Net Security, X.Org has fixed eight vulnerabilities in the X.Org X server and Xwayland. Help Net Security reports that the fixes ship in xorg-server 21.1.26 and xwayland 24.1.15, and that each of the eight affects versions before those two releases. The outlet says the flaws can crash the server, corrupt its memory, or make it read or write outside the memory it should touch, and that one can leak memory contents. This advisory rests on that single outlet’s report. We did not review an X.Org advisory or a CVE record directly, so the CVE descriptions below are the outlet’s.

Help Net Security describes the eight issues as follows:

• CVE-2026-109091: in the Xorg server code that reads EDID, the data a monitor sends to describe its supported modes. Display-range entries are copied into fixed-size arrays without checking the count. A rigged monitor or crafted EDID could crash the server or corrupt memory, the outlet says.
• CVE-2026-109092: in the Xv extension. A negative size from hardware-specific code plus a crafted offset wraps the bounds check in XvShmPutImage, which can let the server read or write outside a shared memory segment, according to the outlet.
• CVE-2026-109095: in glamor acceleration code. Image sizes computed with 32-bit integers wrap to small values for large images, so the server reads past the data the client sent, the outlet says.
• CVE-2026-109096 and CVE-2026-109903: both start from a negative image size in Xv. One lets a request with no image data pass the length check. The other reports the bogus size to the client, per Help Net Security.
• CVE-2026-109093: an out-of-bounds stack write in XTest. Input values are copied into a fixed-size stack array before the server checks that they fit, according to the outlet.
• CVE-2026-109904 and CVE-2026-109094: integer overflows in the X-Resource extension. On 32-bit servers, a large count wraps so a short request passes the length check, and the server reads or walks past the end of the request buffer, the outlet says.

Help Net Security says X.Org released xorg-server 21.1.26 about a month after 21.1.25, which fixed 12 flaws.

Am I affected?

Per Help Net Security, all eight flaws affect X.Org X server and Xwayland versions before xorg-server 21.1.26 and xwayland 24.1.15. The outlet says the X server is the display layer for many Linux and Unix desktops, and that Wayland users who run X11 applications through Xwayland are exposed too.

Per the same report, the EDID flaw (CVE-2026-109091) needs a malicious monitor or a doctored EDID in front of the server. The other seven sit in code that handles X protocol requests. The outlet describes the two X-Resource overflows as affecting 32-bit servers.

Not confirmed in the source:

• Severity ratings or CVSS scores. Help Net Security says X.Org published none, so this advisory assigns no rating of its own beyond info.
• Whether any of the eight can lead to code execution. The outlet says X.Org did not say.
• Any exploitation in the wild. The source does not mention it.

Help Net Security suggests weighing first the three that can write out of bounds: CVE-2026-109091, CVE-2026-109092 and CVE-2026-109093. This is the outlet’s suggestion, not an official rating.

What to do now

1. Check which xorg-server and xwayland versions your systems run. Versions before 21.1.26 and 24.1.15 are affected, according to Help Net Security.
2. Update to xorg-server 21.1.26 and xwayland 24.1.15 where you build or install upstream releases. This is needed even if you already installed 21.1.25 last month.
3. If you use distribution packages, look for the CVE numbers above in your distribution’s security advisory. Help Net Security notes that distributions usually backport patches into their own package versions, so the version number alone may not show whether you are fixed.
4. Prioritize systems according to your own risk assessment, since no official severity ratings were published. The outlet suggests starting with the three out-of-bounds write flaws.

Sources

• Help Net Security: X.Org patches eight server vulnerabilities a month after fixing 12 others