AZL-111494: CVE-2026-93521 affecting package wayland 1.22.0-1

Q: What level of access does an attacker need to exploit this issue?

An attacker must be an authenticated X client. The issue is not described as exploitable by an unauthenticated party.

Q: What could successful exploitation allow?

A malicious authenticated X client could crash the X server or execute code in the X server's context.

Q: Which component versions should be checked?

Check the installed X.Org X Server and XWayland versions. The issue affects X.Org X Server versions before 2.1.25 and XWayland versions before 24.4.14.

Published Oct 28, 2026

Updated

A buffer overflow in RandR ChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14 could be used by authenticated X clients to crash or execute code within the X server context.

Affected Software

1 affected component

azure-linux/wayland<=1.22.0-1

Event History

Oct 28, 2026

Advisory Published

via OSV·04:17 PM

Data Sourced

via OSV·04:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-93521

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

An attacker must be an authenticated X client. The issue is not described as exploitable by an unauthenticated party.

What could successful exploitation allow?

A malicious authenticated X client could crash the X server or execute code in the X server's context.

Which component versions should be checked?

Check the installed X.Org X Server and XWayland versions. The issue affects X.Org X Server versions before 2.1.25 and XWayland versions before 24.4.14.

AZL-111494: CVE-2026-93521 affecting package wayland 1.22.0-1

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What could successful exploitation allow?

Which component versions should be checked?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What could successful exploitation allow?

Which component versions should be checked?