DEBIAN-CVE-2026-93517: Buffer Overflow

Q: Who can exploit this issue?

An authenticated X client can trigger the overflow. The attack is local in the supplied severity vector, so remote access alone is not indicated.

Q: What is the potential impact?

Successful exploitation could crash the X server or result in code execution in the X server context. Confidentiality, integrity, and availability impacts are all rated high in the supplied vector.

Q: Which deployments should be prioritized for remediation?

Systems running X.org X server versions before 21.1.25 or XWayland versions before 24.1.14 are affected according to the provided data. Debian deployments using xorg-server or xwayland should be checked for those version thresholds.

Published Oct 28, 2026

Updated

A heap buffer overflow in handling GLX RenderLarge request where dataBytes exceeds cmdlen in X.org X server before 21.1.25 and XWayland before 24.1.14 that could be be triggered by an authenticated X client could cause crashes or code execution in X server context.

Affected Software

6 affected componentsFixes available

debian/xorg-server*

debian/xorg-server<2:21.1.25-1

2:21.1.25-1

debian/xwayland*

debian/xwayland<2:24.1.14-1

2:24.1.14-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/xorg-server to a version that resolves this vulnerability.
Fixed in 2:21.1.25-1
Upgrade
Upgrade debian/xwayland to a version that resolves this vulnerability.
Fixed in 2:24.1.14-1

Event History

Oct 28, 2026

CVE Published

via OSV·02:17 PM

Data Sourced

via OSV·02:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can exploit this issue?

An authenticated X client can trigger the overflow. The attack is local in the supplied severity vector, so remote access alone is not indicated.

What is the potential impact?

Successful exploitation could crash the X server or result in code execution in the X server context. Confidentiality, integrity, and availability impacts are all rated high in the supplied vector.

Which deployments should be prioritized for remediation?

Systems running X.org X server versions before 21.1.25 or XWayland versions before 24.1.14 are affected according to the provided data. Debian deployments using xorg-server or xwayland should be checked for those version thresholds.

DEBIAN-CVE-2026-93517: Buffer Overflow

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the potential impact?

Which deployments should be prioritized for remediation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the potential impact?

Which deployments should be prioritized for remediation?