AZL-113852: CVE-2026-109096 affecting package xorg-x11-server 1.20.10-6

Q: Who can exploit this issue?

An authenticated X client can trigger the flaw by sending XvPutImage requests. The described impact is a crash of the X server.

Q: Which upstream versions are affected?

X.Org xwayland versions before 24.1.15 and X Server versions before 21.1.26 are affected according to the advisory.

Published Nov 13, 2026

Updated

Incorrect handling of negative returns from ddQueryImageAttributes() when processing XvPutImage requests in X.Org xwayland before 24.1.15 and X Server before 21.1.26 could be used by authenticated X clients to crash the X server.

Affected Software

1 affected component

azure-linux/xorg-x11-server<=1.20.10-6

Event History

Nov 13, 2026

Advisory Published

via OSV·02:17 PM

Data Sourced

via OSV·02:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-109096

Frequently Asked Questions

Who can exploit this issue?

An authenticated X client can trigger the flaw by sending XvPutImage requests. The described impact is a crash of the X server.

Which upstream versions are affected?

X.Org xwayland versions before 24.1.15 and X Server versions before 21.1.26 are affected according to the advisory.

AZL-113852: CVE-2026-109096 affecting package xorg-x11-server 1.20.10-6

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

Who can exploit this issue?

Which upstream versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which upstream versions are affected?