DEBIAN-CVE-2026-93519: Buffer Overflow

Q: Who can exploit this issue?

An authenticated X client can trigger the flaw. Exploitation requires local access and privileges sufficient to connect to the affected X server; no user interaction is required.

Q: What could successful exploitation do?

An attacker may crash the X server or potentially execute code in the X server's context. The listed impact includes high confidentiality, integrity, and availability consequences.

Q: Which upstream versions contain the fix?

The issue affects X.Org X server versions before 21.1.25 and XWayland versions before 24.1.14. The provided data does not identify specific Debian package versions containing the fix.

Published Oct 28, 2026

Updated

A buffer overflow when handling pointer barriers in the XFIXES extension in X.Org X server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.

Affected Software

6 affected componentsFixes available

debian/xorg-server*

debian/xorg-server<2:21.1.25-1

2:21.1.25-1

debian/xwayland*

debian/xwayland<2:24.1.14-1

2:24.1.14-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/xorg-server to a version that resolves this vulnerability.
Fixed in 2:21.1.25-1
Upgrade
Upgrade debian/xwayland to a version that resolves this vulnerability.
Fixed in 2:24.1.14-1
Upgrade
Upgrade X.Org X server to a version that resolves this vulnerability.
Fixed in 21.1.25
Upgrade
Upgrade XWayland to a version that resolves this vulnerability.
Fixed in 24.1.14

Event History

Oct 28, 2026

CVE Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can exploit this issue?

An authenticated X client can trigger the flaw. Exploitation requires local access and privileges sufficient to connect to the affected X server; no user interaction is required.

What could successful exploitation do?

An attacker may crash the X server or potentially execute code in the X server's context. The listed impact includes high confidentiality, integrity, and availability consequences.

Which upstream versions contain the fix?

The issue affects X.Org X server versions before 21.1.25 and XWayland versions before 24.1.14. The provided data does not identify specific Debian package versions containing the fix.

DEBIAN-CVE-2026-93519: Buffer Overflow

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What could successful exploitation do?

Which upstream versions contain the fix?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What could successful exploitation do?

Which upstream versions contain the fix?