CVE-2026-109903: Debian/xorg-server vulnerability

No affected version ranges or fixed versions are provided in the available data. The listed Debian packages are xorg-server and xwayland.

No. The available data does not describe attacker access requirements, affected configurations, exploitation conditions, or temporary mitigations.

Debian's security tracker entry and the OSV record are listed as references for this CVE. The X.Org announcement is also referenced.

Published Nov 10, 2026

Updated

X.Org Server XvQueryImageAttributes Negative Size Reply

Affected Software

8 affected components

debian/xorg-server*

debian/xwayland*

debian/xorg-server<=2:21.1.7-3+deb12u12, <=2:21.1.7-3+deb12u13, <=2:21.1.16-1.3+deb13u3, <=2:21.1.16-1.3+deb13u4, <=2:21.1.25-2

debian/xwayland<=2:22.1.9-1, <=2:24.1.6-1, <=2:24.1.14-1

Nov 10, 2026

CVE Published

via OSV·10:47 PM

Data Sourced

via OSV·10:47 PM

DescriptionAffected Software

No affected version ranges or fixed versions are provided in the available data. The listed Debian packages are xorg-server and xwayland.

No. The available data does not describe attacker access requirements, affected configurations, exploitation conditions, or temporary mitigations.

Debian's security tracker entry and the OSV record are listed as references for this CVE. The X.Org announcement is also referenced.