DEBIAN-CVE-2026-88812: Double Free

Q: What access does an attacker need to exploit this issue?

The attacker needs local access and low privileges. No user interaction is required.

Q: What could successful exploitation allow?

Exploitation can crash the X server and may allow code execution in the X server context. The listed impacts include high confidentiality, integrity, and availability impact.

Q: Which upstream version boundaries are affected?

X.Org X Server versions before 21.1.25 and Xwayland versions before 24.1.14 are affected.

Published Oct 27, 2026

Updated

A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a crash or potentially code in the x server context.

Affected Software

6 affected componentsFixes available

debian/xorg-server*

debian/xorg-server<2:21.1.25-1

2:21.1.25-1

debian/xwayland*

debian/xwayland<2:24.1.14-1

2:24.1.14-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/xorg-server to a version that resolves this vulnerability.
Fixed in 2:21.1.25-1
Upgrade
Upgrade debian/xwayland to a version that resolves this vulnerability.
Fixed in 2:24.1.14-1

Event History

Oct 27, 2026

CVE Published

via OSV·06:17 PM

Data Sourced

via OSV·06:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attacker needs local access and low privileges. No user interaction is required.

What could successful exploitation allow?

Exploitation can crash the X server and may allow code execution in the X server context. The listed impacts include high confidentiality, integrity, and availability impact.

Which upstream version boundaries are affected?

X.Org X Server versions before 21.1.25 and Xwayland versions before 24.1.14 are affected.

DEBIAN-CVE-2026-88812: Double Free

Affected Software

Remediation

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What could successful exploitation allow?

Which upstream version boundaries are affected?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What could successful exploitation allow?

Which upstream version boundaries are affected?