AZL-111503: CVE-2026-93536 affecting package wayland 1.22.0-1

Q: Which installed components should be checked during triage?

Check the X.Org X Server and XWayland versions. The affected upstream version ranges are X.Org X Server before 21.1.25 and XWayland before 24.1.14.

Q: What level of access does an attacker need?

Exploitation requires an authenticated X client. The issue could allow such a client to crash the X server or potentially execute code.

Published Oct 28, 2026

Updated

A use after free caused by missing lifecycle management of gesture sprites in GestureBuildSprite() in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash the X server or potentially execute code.

Affected Software

1 affected component

azure-linux/wayland<=1.22.0-1

Event History

Oct 28, 2026

Advisory Published

via OSV·05:18 PM

Data Sourced

via OSV·05:18 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-93536

Frequently Asked Questions

Which installed components should be checked during triage?

Check the X.Org X Server and XWayland versions. The affected upstream version ranges are X.Org X Server before 21.1.25 and XWayland before 24.1.14.

What level of access does an attacker need?

Exploitation requires an authenticated X client. The issue could allow such a client to crash the X server or potentially execute code.

AZL-111503: CVE-2026-93536 affecting package wayland 1.22.0-1

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

Which installed components should be checked during triage?

What level of access does an attacker need?

Company

Resources

Contact

Frequently Asked Questions

Which installed components should be checked during triage?

What level of access does an attacker need?