ALPINE-CVE-2026-109903: High severity alpine/xorg-server vulnerability
A buffer overread caused by casting a negative integer to CARD32 in XvQueryImageAttributes in X.Org X Server before 21.1.26 and xwayland before 24.1.15 could be used to causes crashes by authenticated X clients.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/xorg-serverto a version that resolves this vulnerability.Fixed in 21.1.26-r0 - Upgrade
Upgrade
alpine/xwaylandto a version that resolves this vulnerability.Fixed in 24.1.15-r0
Event History
Frequently Asked Questions
Which Alpine deployments should be prioritized for review?
Review systems running alpine/xorg-server with X.Org X Server versions before 21.1.26, and systems running alpine/xwayland before 24.1.15. Systems not running either affected component are not identified as affected by the provided data.
What level of access does an attacker need?
An attacker needs to be an authenticated X client. The vector is local, requires low privileges, and does not require user interaction.
How can I determine whether a system is affected?
Check whether alpine/xorg-server or alpine/xwayland is installed and identify its installed version. Treat X.Org X Server versions earlier than 21.1.26 and xwayland versions earlier than 24.1.15 as affected.