AZL-112297: CVE-2026-93522 affecting package xorg-x11-server-Xwayland for versions less than 24.1.14-1

Q: Who can exploit this issue?

An authenticated X client can trigger the vulnerable CPU-to-FBO CopyArea path. Systems running an affected X.Org X Server or XWayland instance are exposed to clients that can authenticate to that server.

Q: What is the potential impact?

Successful exploitation may crash the X server or potentially allow code execution in the X server context.

Q: Which versions are affected?

The issue affects X.Org X Server versions before 21.1.15 and XWayland versions before 24.1.14. The listed Azure Linux package is affected at versions earlier than 24.1.14-1.

Published Oct 28, 2026

Updated

A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in the X server context.

Affected Software

1 affected componentFixes available

azure-linux/xorg-x11-server-xwayland<24.1.14-1

24.1.14-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade azure-linux/xorg-x11-server-Xwayland to a version that resolves this vulnerability.
Fixed in 24.1.14-1
Upgrade
Upgrade X.Org X Server to a version that resolves this vulnerability.
Fixed in 21.1.15
Upgrade
Upgrade xorg-x11-server-Xwayland to a version that resolves this vulnerability.
Fixed in 24.1.14-1

Event History

Oct 28, 2026

Advisory Published

via OSV·04:17 PM

Data Sourced

via OSV·04:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-93522

Frequently Asked Questions

Who can exploit this issue?

An authenticated X client can trigger the vulnerable CPU-to-FBO CopyArea path. Systems running an affected X.Org X Server or XWayland instance are exposed to clients that can authenticate to that server.

What is the potential impact?

Successful exploitation may crash the X server or potentially allow code execution in the X server context.

Which versions are affected?

The issue affects X.Org X Server versions before 21.1.15 and XWayland versions before 24.1.14. The listed Azure Linux package is affected at versions earlier than 24.1.14-1.

AZL-112297: CVE-2026-93522 affecting package xorg-x11-server-Xwayland for versions less than 24.1.14-1

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who can exploit this issue?

What is the potential impact?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the potential impact?

Which versions are affected?