AZL-112276: CVE-2026-93518 affecting package xorg-x11-server-Xwayland for versions less than 24.1.14-1

Q: Who can exploit this issue?

An attacker needs to be an authenticated X client. The issue affects the X server and XWayland components described as vulnerable, rather than requiring only network-level access.

Q: What could exploitation cause?

Successful exploitation could crash the X server. The heap buffer overflow may also allow potential code execution in the X server.

Q: Which package versions are affected?

The affected Azure Linux package is xorg-x11-server-Xwayland at versions earlier than 24.1.14-1. The underlying issue is described as affecting X.org X server versions before 21.1.25 and XWayland versions before 24.1.14.

Published Oct 28, 2026

Updated

An integer truncation issue in XkbResizeKeyType() that could lead to a heap buffer overflow by authenticated X clients in X.org X server before 21.1.25 and XWayland before 24.1.14 could be exploited for crashes or potential code execution in the X server.

Affected Software

1 affected componentFixes available

azure-linux/xorg-x11-server-xwayland<24.1.14-1

24.1.14-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade azure-linux/xorg-x11-server-Xwayland to a version that resolves this vulnerability.
Fixed in 24.1.14-1
Upgrade
Upgrade X.org X server to a version that resolves this vulnerability.
Fixed in 21.1.25
Upgrade
Upgrade xorg-x11-server-Xwayland to a version that resolves this vulnerability.
Fixed in 24.1.14-1

Event History

Oct 28, 2026

Advisory Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-93518

Frequently Asked Questions

Who can exploit this issue?

An attacker needs to be an authenticated X client. The issue affects the X server and XWayland components described as vulnerable, rather than requiring only network-level access.

What could exploitation cause?

Successful exploitation could crash the X server. The heap buffer overflow may also allow potential code execution in the X server.

Which package versions are affected?

The affected Azure Linux package is xorg-x11-server-Xwayland at versions earlier than 24.1.14-1. The underlying issue is described as affecting X.org X server versions before 21.1.25 and XWayland versions before 24.1.14.

AZL-112276: CVE-2026-93518 affecting package xorg-x11-server-Xwayland for versions less than 24.1.14-1

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who can exploit this issue?

What could exploitation cause?

Which package versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What could exploitation cause?

Which package versions are affected?