ALPINE-CVE-2026-109091: Buffer Overflow

Q: Which systems are realistically exposed?

Systems running Xwayland before 24.1.15 or X Server before 21.1.26 are exposed when they handle EDID Display-Range descriptors from a malicious monitor. The CVSS vector indicates local access and low privileges are required.

Q: How can I determine whether a system is affected?

Check the installed Xwayland and X Server versions. Xwayland versions earlier than 24.1.15 and X Server versions earlier than 21.1.26 are affected.

Published Nov 13, 2026

Updated

A buffer overflow in handling EDID Display-Range descriptors in X.Org xwayland before 24.1.15 and X Server before 21.1.26 could be used by malicious monitors to crash the x server or execute cote.

Affected Software

1 affected componentFixes available

alpine/xorg-server<21.1.26-r0

21.1.26-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade alpine/xorg-server to a version that resolves this vulnerability.
Fixed in 21.1.26-r0

Event History

Nov 13, 2026

CVE Published

via OSV·04:17 PM

Data Sourced

via OSV·04:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are realistically exposed?

Systems running Xwayland before 24.1.15 or X Server before 21.1.26 are exposed when they handle EDID Display-Range descriptors from a malicious monitor. The CVSS vector indicates local access and low privileges are required.

How can I determine whether a system is affected?

Check the installed Xwayland and X Server versions. Xwayland versions earlier than 24.1.15 and X Server versions earlier than 21.1.26 are affected.

ALPINE-CVE-2026-109091: Buffer Overflow

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems are realistically exposed?

How can I determine whether a system is affected?

Company

Resources

Contact

Frequently Asked Questions

Which systems are realistically exposed?

How can I determine whether a system is affected?