AZL-112306: CVE-2026-93520 affecting package xorg-x11-server-Xwayland for versions less than 24.1.14-1

Q: Who can exploit this issue?

An attacker must be an authenticated X client. The issue affects the X.org X server and XWayland in the vulnerable version ranges.

Q: What could successful exploitation allow?

A malicious authenticated X client could crash the X server. It could also potentially execute code in the X server's context.

Q: Which package versions are affected?

The affected Azure Linux package is xorg-x11-server-Xwayland at versions earlier than 24.1.14-1. The underlying issue also affects X.org X server versions before 2.1.25.

Published Oct 28, 2026

Updated

A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange in X.org X server before 2.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.

Affected Software

1 affected componentFixes available

azure-linux/xorg-x11-server-xwayland<24.1.14-1

24.1.14-1

Event History

Oct 28, 2026

Advisory Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-93520

Frequently Asked Questions

Who can exploit this issue?

An attacker must be an authenticated X client. The issue affects the X.org X server and XWayland in the vulnerable version ranges.

What could successful exploitation allow?

A malicious authenticated X client could crash the X server. It could also potentially execute code in the X server's context.

Which package versions are affected?

The affected Azure Linux package is xorg-x11-server-Xwayland at versions earlier than 24.1.14-1. The underlying issue also affects X.org X server versions before 2.1.25.

AZL-112306: CVE-2026-93520 affecting package xorg-x11-server-Xwayland for versions less than 24.1.14-1

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

Who can exploit this issue?

What could successful exploitation allow?

Which package versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What could successful exploitation allow?

Which package versions are affected?