DEBIAN-CVE-2026-93536: Use After Free

Q: Who can attempt to exploit this issue?

An authenticated X client is required. The vector is local, and the supplied metrics indicate low privileges are sufficient and no user interaction is required.

Q: Which Debian software should be checked for exposure?

Check installations of debian/xorg-server and debian/xwayland. The affected upstream components are X.Org X Server before 21.1.25 and XWayland before 24.1.14.

Q: What is the likely operational impact of a successful exploit?

An attacker may be able to crash the X server, causing availability impact. The issue may also potentially permit code execution, with low confidentiality impact indicated by the supplied severity vector.

Published Oct 28, 2026

Updated

A use after free caused by missing lifecycle management of gesture sprites in GestureBuildSprite() in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash the X server or potentially execute code.

Affected Software

6 affected componentsFixes available

debian/xorg-server*

debian/xorg-server<2:21.1.25-1

2:21.1.25-1

debian/xwayland*

debian/xwayland<2:24.1.14-1

2:24.1.14-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/xorg-server to a version that resolves this vulnerability.
Fixed in 2:21.1.25-1
Upgrade
Upgrade debian/xwayland to a version that resolves this vulnerability.
Fixed in 2:24.1.14-1

Event History

Oct 28, 2026

CVE Published

via OSV·05:18 PM

Data Sourced

via OSV·05:18 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can attempt to exploit this issue?

An authenticated X client is required. The vector is local, and the supplied metrics indicate low privileges are sufficient and no user interaction is required.

Which Debian software should be checked for exposure?

Check installations of debian/xorg-server and debian/xwayland. The affected upstream components are X.Org X Server before 21.1.25 and XWayland before 24.1.14.

What is the likely operational impact of a successful exploit?

An attacker may be able to crash the X server, causing availability impact. The issue may also potentially permit code execution, with low confidentiality impact indicated by the supplied severity vector.

DEBIAN-CVE-2026-93536: Use After Free

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can attempt to exploit this issue?

Which Debian software should be checked for exposure?

What is the likely operational impact of a successful exploit?

Company

Resources

Contact

Frequently Asked Questions

Who can attempt to exploit this issue?

Which Debian software should be checked for exposure?

What is the likely operational impact of a successful exploit?