CVE-2026-109094: Debian/xorg-server vulnerability
Published Nov 10, 2026
·Updated
X.Org Server XRes QueryResourceBytes Swap Path Size Overflow
Affected Software
8 affected components
debian/xorg-server*
debian/xorg-server*
debian/xorg-server*
debian/xwayland*
debian/xwayland*
debian/xwayland*
debian/xorg-server<=2:21.1.7-3+deb12u12, <=2:21.1.7-3+deb12u13, <=2:21.1.16-1.3+deb13u3, <=2:21.1.16-1.3+deb13u4, <=2:21.1.25-2
debian/xwayland<=2:22.1.9-1, <=2:24.1.6-1, <=2:24.1.14-1
Event History
Nov 10, 2026
CVE Published
via OSV·10:47 PM
Data Sourced
via OSV·10:47 PM
DescriptionAffected Software
Frequently Asked Questions
1
Which Debian package entries are associated with this issue?
The affected software entries listed are debian/xorg-server and debian/xwayland.
2
Are fixed versions or temporary mitigations provided?
No fixed versions or mitigation steps are included in the available data.