7.8 High

CVE-2026-93522 X.Org Server Glamor CopyArea Heap Buffer Overflow

Description

A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in the X server context.

CVSS 3.1 detail

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitable with local access to the machine, with an ordinary account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Local
Attack complexity: Low
Privileges required: Low
Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Affected products and versions

Product	Affected versions	Fixed in
xorg-x11-server 21.1	earliest → < 21.1.25	21.1.25
xwayland 9	9 → < 24.1.14	24.1.14

References

gitlab.freedesktop.org gitlab.freedesktop.org

Timeline

Published October 28, 2026
Last modified November 5, 2026

The 12 CVEs of xorg-x11-server →

CVE-2026-93536 A use after free caused by missing lifecycle management of gesture sprites in GestureBuildSprite() in X.Org X Server… 5.3 Medium CVE-2026-93524 A buffer overread in CheckKeySyms() in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by… 6.9 Medium CVE-2026-93523 A heap buffer overflow caused by a XIPassiveUngrabDevice request with an out-of-range modifier value in X.Org X Server… 7.8 High CVE-2026-93521 A buffer overflow in RandR ChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14… 7.8 High

Track this CVE