AZL-113888: CVE-2026-109094 affecting package xorg-x11-server-Xwayland 24.1.14-1

Q: Which systems are exposed to this issue?

The issue affects 32-bit systems running Xwayland before 24.1.15 or X Server before 21.1.26. The affected Azure Linux package is xorg-x11-server-Xwayland 24.1.14-1.

Q: What does an attacker need to exploit it?

An attacker needs to be an authenticated client able to send requests through the XRes QueryResourceBytes swap path. The described impact is crashing the X server.

Q: Is this a remote unauthenticated vulnerability?

No. The available information identifies authenticated clients as the attack prerequisite; it does not describe unauthenticated exploitation.

Published Nov 13, 2026

Updated

A integer overflow that can lead to a buffer overrread in the XRes QueryResourceBytes Swap Path in the X.Org xwayland before 24.1.15 and X Server before 21.1.26 on 32bit systems could be used by authenticated clients to crash the X server.

Affected Software

1 affected component

azure-linux/xorg-x11-server-xwayland<=24.1.14-1

Event History

Nov 13, 2026

Advisory Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-109094

Frequently Asked Questions

Which systems are exposed to this issue?

The issue affects 32-bit systems running Xwayland before 24.1.15 or X Server before 21.1.26. The affected Azure Linux package is xorg-x11-server-Xwayland 24.1.14-1.

What does an attacker need to exploit it?

An attacker needs to be an authenticated client able to send requests through the XRes QueryResourceBytes swap path. The described impact is crashing the X server.

Is this a remote unauthenticated vulnerability?

No. The available information identifies authenticated clients as the attack prerequisite; it does not describe unauthenticated exploitation.

AZL-113888: CVE-2026-109094 affecting package xorg-x11-server-Xwayland 24.1.14-1

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

Which systems are exposed to this issue?

What does an attacker need to exploit it?

Is this a remote unauthenticated vulnerability?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What does an attacker need to exploit it?

Is this a remote unauthenticated vulnerability?