AZL-113831: CVE-2026-109903 affecting package xorg-x11-server-Xwayland 24.1.14-1

Q: Who can trigger the issue?

An authenticated X client can trigger the buffer overread and cause crashes. The provided information does not indicate that unauthenticated or remote attackers can exploit it.

Q: Which versions are affected and which version contains the fix?

Xwayland versions before 24.1.15 are affected. The listed package version 24.1.14-1 falls within the affected range; update to a package providing Xwayland 24.1.15 or later.

Q: What is the expected impact of exploitation?

The described impact is a crash caused by a buffer overread in XvQueryImageAttributes. No information is provided indicating code execution, privilege escalation, or data disclosure.

Published Nov 13, 2026

Updated

A buffer overread caused by casting a negative integer to CARD32 in XvQueryImageAttributes in X.Org X Server before 21.1.26 and xwayland before 24.1.15 could be used to causes crashes by authenticated X clients.

Affected Software

1 affected component

azure-linux/xorg-x11-server-xwayland<=24.1.14-1

Event History

Nov 13, 2026

Advisory Published

via OSV·11:17 AM

Data Sourced

via OSV·11:17 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-109903

Frequently Asked Questions

Who can trigger the issue?

An authenticated X client can trigger the buffer overread and cause crashes. The provided information does not indicate that unauthenticated or remote attackers can exploit it.

Which versions are affected and which version contains the fix?

Xwayland versions before 24.1.15 are affected. The listed package version 24.1.14-1 falls within the affected range; update to a package providing Xwayland 24.1.15 or later.

What is the expected impact of exploitation?

The described impact is a crash caused by a buffer overread in XvQueryImageAttributes. No information is provided indicating code execution, privilege escalation, or data disclosure.

AZL-113831: CVE-2026-109903 affecting package xorg-x11-server-Xwayland 24.1.14-1

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

Who can trigger the issue?

Which versions are affected and which version contains the fix?

What is the expected impact of exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can trigger the issue?

Which versions are affected and which version contains the fix?

What is the expected impact of exploitation?