DEBIAN-CVE-2026-93524: Medium severity debian/xorg-server vulnerability
Published Oct 28, 2026
·Updated
A buffer overread in CheckKeySyms() in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to leak small amounts of information from X server memory or potentially crash the X server.
Affected Software
6 affected componentsFixes available
debian/xorg-server*
debian/xorg-server*
debian/xorg-server<2:21.1.25-1
2:21.1.25-1
debian/xwayland*
debian/xwayland*
debian/xwayland<2:24.1.14-1
2:24.1.14-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/xorg-serverto a version that resolves this vulnerability.Fixed in 2:21.1.25-1 - Upgrade
Upgrade
debian/xwaylandto a version that resolves this vulnerability.Fixed in 2:24.1.14-1
Event History
Oct 28, 2026
CVE Published
via OSV·05:18 PM
Data Sourced
via OSV·05:18 PM
DescriptionSeverityAffected Software