DEBIAN-CVE-2026-93518: Buffer Overflow

Q: What access does an attacker need to exploit this issue?

An attacker needs local access and low-level privileges, and must be able to act as an authenticated X client. No user interaction is required.

Q: Which versions should be considered affected?

X.org X server versions before 21.1.25 and XWayland versions before 24.1.14 are affected. Systems running either component should verify the installed version.

Q: What is the likely impact if exploitation succeeds?

Successful exploitation can crash the X server and may allow code execution in the X server process. The vulnerability affects confidentiality, integrity, and availability.

Published Oct 28, 2026

Updated

An integer truncation issue in XkbResizeKeyType() that could lead to a heap buffer overflow by authenticated X clients in X.org X server before 21.1.25 and XWayland before 24.1.14 could be exploited for crashes or potential code execution in the X server.

Affected Software

6 affected componentsFixes available

debian/xorg-server*

debian/xorg-server<2:21.1.25-1

2:21.1.25-1

debian/xwayland*

debian/xwayland<2:24.1.14-1

2:24.1.14-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/xorg-server to a version that resolves this vulnerability.
Fixed in 2:21.1.25-1
Upgrade
Upgrade debian/xwayland to a version that resolves this vulnerability.
Fixed in 2:24.1.14-1

Event History

Oct 28, 2026

CVE Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What access does an attacker need to exploit this issue?

An attacker needs local access and low-level privileges, and must be able to act as an authenticated X client. No user interaction is required.

Which versions should be considered affected?

X.org X server versions before 21.1.25 and XWayland versions before 24.1.14 are affected. Systems running either component should verify the installed version.

What is the likely impact if exploitation succeeds?

Successful exploitation can crash the X server and may allow code execution in the X server process. The vulnerability affects confidentiality, integrity, and availability.

DEBIAN-CVE-2026-93518: Buffer Overflow

Affected Software

Remediation

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which versions should be considered affected?

What is the likely impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which versions should be considered affected?

What is the likely impact if exploitation succeeds?