{"id":"CVE-2026-109093","kind":"vulnerability","aliases":["CVE-2026-109093"],"related":[],"title":"X.Org xwayland and X server: stack overflow lets clients run code","description":"A stack buffer overflow in  ProcXTestFakeInput DeviceValuator handling in X.Org xwayland before 24.1.15 and X server before 21.1.26 could be used by authenticated clients to crash or execute code in the X server.","summary":"A stack buffer overflow in the XTEST fake-input handling of X.Org xwayland before 24.1.15 and the X server before 21.1.26 lets an authenticated client crash the server. The same flaw could let that client execute code inside the X server.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","infrastructure","linux","x.org","xwayland"],"not_affected_if":["fixed-version-installed","wayland-only-no-xwayland"],"how_to_check":"- Check the installed X server version with `Xorg -version` or `Xwayland -version`.\n- Compare the result against `21.1.26` for the X server and `24.1.15` for xwayland.","fix":"- X server: move to `21.1.26` or later.\n- xwayland: move to `24.1.15` or later.","status":"open","published_at":"2026-11-13T15:17:29+00:00","first_seen_at":"2026-11-13T15:46:15+00:00","triaged_at":"2026-11-13T15:48:19+00:00","updated_at":"2026-11-13T15:48:19+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-13T15:48:19Z","model":"claude-haiku-5-5","output":{"fix":"- X server: move to `21.1.26` or later.\n- xwayland: move to `24.1.15` or later.","reach":"local","title":"X.Org xwayland and X server: stack overflow lets clients run code","impact":"high","summary":"A stack buffer overflow in the XTEST fake-input handling of X.Org xwayland before 24.1.15 and the X server before 21.1.26 lets an authenticated client crash the server. The same flaw could let that client execute code inside the X server.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["x.org","xwayland","linux","desktop"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated client executes code inside the X server","analyst_note":"","how_to_check":"- Check the installed X server version with `Xorg -version` or `Xwayland -version`.\n- Compare the result against `21.1.26` for the X server and `24.1.15` for xwayland.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["wayland-only-no-xwayland","fixed-version-installed"],"who_is_affected":"Systems running an X server or xwayland older than the fixed versions are exposed, and the attacker must already be an authenticated client of that server. Wayland-only desktops that do not run xwayland are not affected by the xwayland part. Sources do not say which default configurations are exposed.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000719,"input_tokens":4547,"output_tokens":528,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-109093':14A,17A '-2026':13A,16A '21.1.26':44B,82C '24.1.15':38B,77C 'authent':47B,87C 'buffer':25B,67C 'client':9A,48B,58B,88C 'code':11A,60B,93C 'could':55B,83C 'crash':49B,90C 'cve':12A,15A 'desktop':18B 'devicevalu':71C 'execut':59B,92C 'fake':31B 'fake-input':30B 'flaw':54B 'handl':33B,72C 'infrastructur':19B 'input':32B 'insid':61B 'let':8A,45B,56B 'linux':20B 'overflow':7A,26B,68C 'procxtestfakeinput':70C 'run':10A 'server':5A,42B,51B,64B,80C,97C 'stack':6A,24B,66C 'use':85C 'x':4A,41B,63B,79C,96C 'x.org':1A,21B,35B,74C 'xtest':29B 'xwayland':2A,22B,36B,75C","nicknames":[],"mitigations":[],"who_affected":"Systems running an X server or xwayland older than the fixed versions are exposed, and the attacker must already be an authenticated client of that server. Wayland-only desktops that do not run xwayland are not affected by the xwayland part. Sources do not say which default configurations are exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["desktop","high","infrastructure","linux","xorg","xwayland"],"campaign_type":null,"search_a":"'-109093':14A,17A '-2026':13A,16A 'client':9A 'code':11A 'cve':12A,15A 'let':8A 'overflow':7A 'run':10A 'server':5A 'stack':6A 'x':4A 'x.org':1A 'xwayland':2A","search_b":"'21.1.26':44B '24.1.15':38B 'authent':47B 'buffer':25B 'client':48B,58B 'code':60B 'could':55B 'crash':49B 'desktop':18B 'execut':59B 'fake':31B 'fake-input':30B 'flaw':54B 'handl':33B 'infrastructur':19B 'input':32B 'insid':61B 'let':45B,56B 'linux':20B 'overflow':26B 'server':42B,51B,64B 'stack':24B 'x':41B,63B 'x.org':21B,35B 'xtest':29B 'xwayland':22B,36B","search_c":"'21.1.26':82C '24.1.15':77C 'authent':87C 'buffer':67C 'client':88C 'code':93C 'could':83C 'crash':90C 'devicevalu':71C 'execut':92C 'handl':72C 'overflow':68C 'procxtestfakeinput':70C 'server':80C,97C 'stack':66C 'use':85C 'x':79C,96C 'x.org':74C 'xwayland':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"meissner@suse.de","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109093","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109093","severity":null,"published_at":"2026-11-13T15:17:29+00:00","modified_at":"2026-11-13T15:17:29+00:00","first_seen_at":"2026-11-13T15:46:15+00:00","fetched_at":"2026-11-13T15:46:15+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}