AZL-113879: CVE-2026-109092 affecting package xorg-x11-server-Xwayland 24.1.14-1

Q: Who can exploit this issue?

Exploitation requires a local, authenticated X client capable of sending ProcXvShmPutImage requests. A successful attacker may crash the X server or execute code.

Q: How can I determine whether my system is affected?

Check the installed Xwayland or X Server version. Xwayland versions before 24.1.15 and X Server versions before 21.1.26 are affected.

Published Nov 13, 2026

Updated

Incorrectly handled negative sizes when processing ProcXvShmPutImage requests in the X.Org xwayland before 24.1.15 and X Server before 21.1.26 could be used by local authenticated X clients to crash the X server or execute code.

Affected Software

1 affected component

azure-linux/xorg-x11-server-xwayland<=24.1.14-1

Event History

Nov 13, 2026

Advisory Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-109092

Frequently Asked Questions

Who can exploit this issue?

Exploitation requires a local, authenticated X client capable of sending ProcXvShmPutImage requests. A successful attacker may crash the X server or execute code.

How can I determine whether my system is affected?

Check the installed Xwayland or X Server version. Xwayland versions before 24.1.15 and X Server versions before 21.1.26 are affected.

AZL-113879: CVE-2026-109092 affecting package xorg-x11-server-Xwayland 24.1.14-1

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

Who can exploit this issue?

How can I determine whether my system is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

How can I determine whether my system is affected?