{"id":"CVE-2026-109092","kind":"vulnerability","aliases":["CVE-2026-109092"],"related":[],"title":"X.Org XWayland and X Server: negative sizes let local clients run code","description":"Incorrectly handled negative sizes when processing ProcXvShmPutImage requests in the X.Org xwayland before 24.1.15 and X Server before 21.1.26 could be used by local authenticated X clients to crash the X server or execute code.","summary":"XWayland and the X Server mishandle negative sizes in ProcXvShmPutImage requests. A local client that is already authenticated to the X server can crash it or execute code.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","infrastructure","linux","xorg","xwayland"],"not_affected_if":["no-x-server","single-user-machine","wayland-only-no-xwayland"],"how_to_check":"- Check the installed XWayland version with `Xwayland -version`, and the X Server version with `Xorg -version`.\n- Compare against the fixed versions: XWayland before `24.1.15` and X Server before `21.1.26` are affected.","fix":"- XWayland: move to `24.1.15` or later.\n- X Server: move to `21.1.26` or later.","status":"open","published_at":"2026-11-13T15:17:29+00:00","first_seen_at":"2026-11-13T15:46:15+00:00","triaged_at":"2026-11-13T15:48:22+00:00","updated_at":"2026-11-13T15:48:22+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-13T15:48:22Z","model":"claude-haiku-5-5","output":{"fix":"- XWayland: move to `24.1.15` or later.\n- X Server: move to `21.1.26` or later.","reach":"local","title":"X.Org XWayland and X Server: negative sizes let local clients run code","impact":"high","summary":"XWayland and the X Server mishandle negative sizes in ProcXvShmPutImage requests. A local client that is already authenticated to the X server can crash it or execute code.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["linux","xorg","xwayland","desktop"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"local client crashes X server or runs code","analyst_note":"","how_to_check":"- Check the installed XWayland version with `Xwayland -version`, and the X Server version with `Xorg -version`.\n- Compare against the fixed versions: XWayland before `24.1.15` and X Server before `21.1.26` are affected.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-x-server","wayland-only-no-xwayland","single-user-machine"],"who_is_affected":"Systems running XWayland before 24.1.15 or X Server before 21.1.26. The attacker must be a local client that is already authenticated to the X server, so exposure is limited to multi-user or shared desktop machines. Machines with no X server or XWayland installed can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000716,"input_tokens":4544,"output_tokens":523,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-109092':15A,18A '-2026':14A,17A '21.1.26':70C '24.1.15':65C 'alreadi':40B 'authent':41B,76C 'client':10A,37B,78C 'code':12A,51B,86C 'could':71C 'crash':47B,80C 'cve':13A,16A 'desktop':19B 'execut':50B,85C 'handl':53C 'incorrect':52C 'infrastructur':20B 'let':8A 'linux':21B 'local':9A,36B,75C 'mishandl':29B 'negat':6A,30B,54C 'process':57C 'procxvshmputimag':33B,58C 'request':34B,59C 'run':11A 'server':5A,28B,45B,68C,83C 'size':7A,31B,55C 'use':73C 'x':4A,27B,44B,67C,77C,82C 'x.org':1A,62C 'xorg':22B 'xwayland':2A,23B,24B,63C","nicknames":[],"mitigations":[],"who_affected":"Systems running XWayland before 24.1.15 or X Server before 21.1.26. The attacker must be a local client that is already authenticated to the X server, so exposure is limited to multi-user or shared desktop machines. Machines with no X server or XWayland installed can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["desktop","high","infrastructure","linux","xorg","xwayland"],"campaign_type":null,"search_a":"'-109092':15A,18A '-2026':14A,17A 'client':10A 'code':12A 'cve':13A,16A 'let':8A 'local':9A 'negat':6A 'run':11A 'server':5A 'size':7A 'x':4A 'x.org':1A 'xwayland':2A","search_b":"'alreadi':40B 'authent':41B 'client':37B 'code':51B 'crash':47B 'desktop':19B 'execut':50B 'infrastructur':20B 'linux':21B 'local':36B 'mishandl':29B 'negat':30B 'procxvshmputimag':33B 'request':34B 'server':28B,45B 'size':31B 'x':27B,44B 'xorg':22B 'xwayland':23B,24B","search_c":"'21.1.26':70C '24.1.15':65C 'authent':76C 'client':78C 'code':86C 'could':71C 'crash':80C 'execut':85C 'handl':53C 'incorrect':52C 'local':75C 'negat':54C 'process':57C 'procxvshmputimag':58C 'request':59C 'server':68C,83C 'size':55C 'use':73C 'x':67C,77C,82C 'x.org':62C 'xwayland':63C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"meissner@suse.de","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109092","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109092","severity":null,"published_at":"2026-11-13T15:17:29+00:00","modified_at":"2026-11-13T15:17:29+00:00","first_seen_at":"2026-11-13T15:46:15+00:00","fetched_at":"2026-11-13T15:46:15+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}