7.8 High

CVE-2026-88812 X.Org Server XKB SetGeometry TextDoodad Double Free

Description

A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a crash or potentially code in the x server context.

CVSS 3.1 detail

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitable with local access to the machine, with an ordinary account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Local
Attack complexity: Low
Privileges required: Low
Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Affected products and versions

Product	Affected versions	Fixed in
xorg-x11-server 21.1	earliest → < 21.1.25	21.1.25
xwayland 24.1	earliest → < 24.1.14	24.1.14

References

gitlab.freedesktop.org gitlab.freedesktop.org

Timeline

Published October 27, 2026
Last modified November 4, 2026

The 12 CVEs of xorg-x11-server →

CVE-2026-93536 A use after free caused by missing lifecycle management of gesture sprites in GestureBuildSprite() in X.Org X Server… 5.3 Medium CVE-2026-93524 A buffer overread in CheckKeySyms() in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by… 6.9 Medium CVE-2026-93523 A heap buffer overflow caused by a XIPassiveUngrabDevice request with an out-of-range modifier value in X.Org X Server… 7.8 High CVE-2026-93522 X.Org Server Glamor CopyArea Heap Buffer Overflow 7.8 High

Track this CVE