AZL-112288: CVE-2026-93521 affecting package xorg-x11-server-Xwayland for versions less than 24.1.14-1

Q: What level of access does an attacker need to exploit this issue?

An attacker needs to be an authenticated X client. The vulnerability is triggered through RandR ChangeProviderProperty requests.

Q: What could exploitation allow?

A successful exploit could crash the X server or execute code in the X server context.

Q: How can I determine whether my Azure Linux package is affected?

Check the installed xorg-x11-server-Xwayland package version. The affected package range is versions earlier than 24.1.14-1.

Published Oct 28, 2026

Updated

A buffer overflow in RandR ChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14 could be used by authenticated X clients to crash or execute code within the X server context.

Affected Software

1 affected componentFixes available

azure-linux/xorg-x11-server-xwayland<24.1.14-1

24.1.14-1

Event History

Oct 28, 2026

Advisory Published

via OSV·04:17 PM

Data Sourced

via OSV·04:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-93521

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

An attacker needs to be an authenticated X client. The vulnerability is triggered through RandR ChangeProviderProperty requests.

What could exploitation allow?

A successful exploit could crash the X server or execute code in the X server context.

How can I determine whether my Azure Linux package is affected?

Check the installed xorg-x11-server-Xwayland package version. The affected package range is versions earlier than 24.1.14-1.

AZL-112288: CVE-2026-93521 affecting package xorg-x11-server-Xwayland for versions less than 24.1.14-1

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What could exploitation allow?

How can I determine whether my Azure Linux package is affected?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What could exploitation allow?

How can I determine whether my Azure Linux package is affected?