CVE-2026-109093 · Infrastructure
NO FIX YET · SEE WHAT TO DO
A stack buffer overflow in the XTEST fake-input handling of X.Org xwayland before 24.1.15 and the X server before 21.1.26 lets an authenticated client crash the server. The same flaw could let that client execute code inside the X server.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Systems running an X server or xwayland older than the fixed versions are exposed, and the attacker must already be an authenticated client of that server. Wayland-only desktops that do not run xwayland are not affected by the xwayland part. Sources do not say which default configurations are exposed.
Not affected if fixed-version-installed, wayland-only-no-xwayland
Who cares desktop, linux, x.org, xwayland
Xorg -version or Xwayland -version.21.1.26 for the X server and 24.1.15 for xwayland.21.1.26 or later.24.1.15 or later.A stack buffer overflow in ProcXTestFakeInput DeviceValuator handling in X.Org xwayland before 24.1.15 and X server before 21.1.26 could be used by authenticated clients to crash or execute code in the X server.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.