AZL-112291: CVE-2026-93536 affecting package xorg-x11-server-Xwayland for versions less than 24.1.14-1
Published Oct 28, 2026
·Updated
A use after free caused by missing lifecycle management of gesture sprites in GestureBuildSprite() in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash the X server or potentially execute code.
Affected Software
1 affected componentFixes available
azure-linux/xorg-x11-server-xwayland<24.1.14-1
24.1.14-1
Event History
Oct 28, 2026
Advisory Published
via OSV·05:18 PM
Data Sourced
via OSV·05:18 PM
DescriptionAffected Software