AZL-113882: CVE-2026-109096 affecting package xorg-x11-server-Xwayland 24.1.14-1

Q: Who can exploit this issue?

An authenticated X client can exploit the issue by sending a crafted XvPutImage request. It is therefore most relevant where untrusted or less-trusted users or applications can connect to the X server.

Q: What is the impact of successful exploitation?

Successful exploitation can crash the X server, causing a denial of service for affected graphical sessions or services.

Q: Which versions are affected and fixed?

Xwayland versions before 24.1.15 and X Server versions before 21.1.26 are affected. The listed Azure Linux package version is xorg-x11-server-Xwayland 24.1.14-1.

Published Nov 13, 2026

Updated

Incorrect handling of negative returns from ddQueryImageAttributes() when processing XvPutImage requests in X.Org xwayland before 24.1.15 and X Server before 21.1.26 could be used by authenticated X clients to crash the X server.

Affected Software

1 affected component

azure-linux/xorg-x11-server-xwayland<=24.1.14-1

Event History

Nov 13, 2026

Advisory Published

via OSV·02:17 PM

Data Sourced

via OSV·02:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-109096

Frequently Asked Questions

Who can exploit this issue?

An authenticated X client can exploit the issue by sending a crafted XvPutImage request. It is therefore most relevant where untrusted or less-trusted users or applications can connect to the X server.

What is the impact of successful exploitation?

Successful exploitation can crash the X server, causing a denial of service for affected graphical sessions or services.

Which versions are affected and fixed?

Xwayland versions before 24.1.15 and X Server versions before 21.1.26 are affected. The listed Azure Linux package version is xorg-x11-server-Xwayland 24.1.14-1.

AZL-113882: CVE-2026-109096 affecting package xorg-x11-server-Xwayland 24.1.14-1

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

Who can exploit this issue?

What is the impact of successful exploitation?

Which versions are affected and fixed?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the impact of successful exploitation?

Which versions are affected and fixed?