CVE-2026-93536: X.Org Server GestureBuildSprite Use-After-Free

Q: Who can exploit this issue?

An authenticated X client is required. The attack is local and has high complexity, so it is most relevant where untrusted or less-trusted users can connect to the affected X server or XWayland instance.

Q: Which versions are affected?

X.Org X Server versions before 21.1.25 and XWayland versions before 24.1.14 are affected.

Q: What can an attacker achieve?

An authenticated X client may crash the X server, causing a denial of service. The flaw may also potentially allow code execution.

Published Oct 28, 2026

Updated

A use after free caused by missing lifecycle management of gesture sprites in GestureBuildSprite() in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash the X server or potentially execute code.

Affected Software

2 affected components

X.Org X Server<21.1.25

X.Org Xwayland<24.1.14

Event History

Oct 28, 2026

CVE Published

via MITRE·04:33 PM

Data Sourced

via MITRE·04:33 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated X client is required. The attack is local and has high complexity, so it is most relevant where untrusted or less-trusted users can connect to the affected X server or XWayland instance.

Which versions are affected?

X.Org X Server versions before 21.1.25 and XWayland versions before 24.1.14 are affected.

What can an attacker achieve?

An authenticated X client may crash the X server, causing a denial of service. The flaw may also potentially allow code execution.

CVE-2026-93536: X.Org Server GestureBuildSprite Use-After-Free

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Which versions are affected?

What can an attacker achieve?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which versions are affected?

What can an attacker achieve?