AZL-112300: CVE-2026-93517 affecting package xorg-x11-server-Xwayland for versions less than 24.1.14-1

Q: Who can exploit this issue?

An authenticated X client can trigger the vulnerable GLX RenderLarge request handling. Systems running an affected X.org X server or XWayland version are exposed to clients that can authenticate to the X server.

Q: What could successful exploitation do?

The heap buffer overflow could crash the X server or enable code execution in the X server context.

Q: Which versions are affected and which package version fixes it?

The issue affects X.org X server versions before 21.1.25 and XWayland versions before 24.1.14. For the listed Azure Linux package, versions earlier than 24.1.14-1 are affected.

Published Oct 28, 2026

Updated

A heap buffer overflow in handling GLX RenderLarge request where dataBytes exceeds cmdlen in X.org X server before 21.1.25 and XWayland before 24.1.14 that could be be triggered by an authenticated X client could cause crashes or code execution in X server context.

Affected Software

1 affected componentFixes available

azure-linux/xorg-x11-server-xwayland<24.1.14-1

24.1.14-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade azure-linux/xorg-x11-server-Xwayland to a version that resolves this vulnerability.
Fixed in 24.1.14-1
Upgrade
Upgrade xorg-x11-server-Xwayland to a version that resolves this vulnerability.
Fixed in 24.1.14-1
Upgrade
Upgrade X.org X server to a version that resolves this vulnerability.
Fixed in 21.1.25

Event History

Oct 28, 2026

Advisory Published

via OSV·02:17 PM

Data Sourced

via OSV·02:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-93517

Frequently Asked Questions

Who can exploit this issue?

An authenticated X client can trigger the vulnerable GLX RenderLarge request handling. Systems running an affected X.org X server or XWayland version are exposed to clients that can authenticate to the X server.

What could successful exploitation do?

The heap buffer overflow could crash the X server or enable code execution in the X server context.

Which versions are affected and which package version fixes it?

The issue affects X.org X server versions before 21.1.25 and XWayland versions before 24.1.14. For the listed Azure Linux package, versions earlier than 24.1.14-1 are affected.

AZL-112300: CVE-2026-93517 affecting package xorg-x11-server-Xwayland for versions less than 24.1.14-1

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who can exploit this issue?

What could successful exploitation do?

Which versions are affected and which package version fixes it?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What could successful exploitation do?

Which versions are affected and which package version fixes it?