AZL-113843: CVE-2026-109093 affecting package xorg-x11-server 1.20.10-6

Q: Who can exploit this issue?

An authenticated X client can exploit the flaw. Systems running the affected X.Org X server or xwayland are exposed to clients that can authenticate to the relevant X server.

Q: What could exploitation allow?

Successful exploitation could crash the X server or execute code in the X server process.

Q: Which upstream versions are affected?

The issue affects xwayland versions before 24.1.15 and X server versions before 21.1.26.

Published Nov 13, 2026

Updated

A stack buffer overflow in ProcXTestFakeInput DeviceValuator handling in X.Org xwayland before 24.1.15 and X server before 21.1.26 could be used by authenticated clients to crash or execute code in the X server.

Affected Software

1 affected component

azure-linux/xorg-x11-server<=1.20.10-6

Event History

Nov 13, 2026

Advisory Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-109093

Frequently Asked Questions

Who can exploit this issue?

An authenticated X client can exploit the flaw. Systems running the affected X.Org X server or xwayland are exposed to clients that can authenticate to the relevant X server.

What could exploitation allow?

Successful exploitation could crash the X server or execute code in the X server process.

Which upstream versions are affected?

The issue affects xwayland versions before 24.1.15 and X server versions before 21.1.26.

AZL-113843: CVE-2026-109093 affecting package xorg-x11-server 1.20.10-6

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

Who can exploit this issue?

What could exploitation allow?

Which upstream versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What could exploitation allow?

Which upstream versions are affected?