AZL-111455: CVE-2026-93520 affecting package xorg-x11-server 1.20.10-6

Q: Who can exploit this issue?

An attacker must be an authenticated X client. Systems that do not allow untrusted or attacker-controlled clients to connect to the X server have a more limited exposure.

Q: What could successful exploitation do?

The issue could crash the X server or potentially allow code execution in the X server context.

Q: Which upstream versions are affected?

The description identifies X.org X server versions before 2.1.25 and XWayland versions before 24.1.14 as affected.

Published Oct 28, 2026

Updated

A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange in X.org X server before 2.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.

Affected Software

1 affected component

azure-linux/xorg-x11-server<=1.20.10-6

Event History

Oct 28, 2026

Advisory Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-93520

Frequently Asked Questions

Who can exploit this issue?

An attacker must be an authenticated X client. Systems that do not allow untrusted or attacker-controlled clients to connect to the X server have a more limited exposure.

What could successful exploitation do?

The issue could crash the X server or potentially allow code execution in the X server context.

Which upstream versions are affected?

The description identifies X.org X server versions before 2.1.25 and XWayland versions before 24.1.14 as affected.

AZL-111455: CVE-2026-93520 affecting package xorg-x11-server 1.20.10-6

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

Who can exploit this issue?

What could successful exploitation do?

Which upstream versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What could successful exploitation do?

Which upstream versions are affected?