FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

X.Org X server and Xwayland -- Multiple vulnerabilities

Affected packages
xephyr < 21.1.26,1
xorg-server < 21.1.26,1
xorg-vfbserver < 21.1.26,1
xorg-nestserver < 21.1.26,2
xwayland < 24.1.15,1

Details

VuXML ID f8802557-dea7-11f1-bf46-901b0e13f1a0
Discovery 2026-11-10
Entry 2026-11-12

X.Org reports:

CVE-2026-109091: X.Org Server EDID DS_RANGES Out-Of-Bounds Write CVE-2026-109092: X.Org Server XvShmPutImage Shared-Memory Bounds Overflow CVE-2026-109093: X.Org Server XTestFakeInput Valuator Stack Out-Of-Bounds Write CVE-2026-109094: X.Org Server XRes QueryResourceBytes Swap Path Size Overflow CVE-2026-109095: X.Org Server glamor Xv Image Size Integer Overflow CVE-2026-109096: X.Org Server XvPutImage Negative Image Size Length Bypass CVE-2026-109903: X.Org Server XvQueryImageAttributes Negative Size Reply CVE-2026-109904: X.Org Server XRes QueryClientIds Request Size Overflow

[source]

References

CVE Name CVE-2026-109091
CVE Name CVE-2026-109092
CVE Name CVE-2026-109093
CVE Name CVE-2026-109094
CVE Name CVE-2026-109095
CVE Name CVE-2026-109096
CVE Name CVE-2026-109903
CVE Name CVE-2026-109904
URL https://lists.x.org/archives/xorg-announce/2026-November/003759.html

Copyright © 2003-2005 Jacques Vidrine and contributors.
Please see the source of this document for full copyright information.