{"id":"CVE-2026-109903","kind":"vulnerability","aliases":["CVE-2026-109903"],"related":[],"title":"X.Org X Server: buffer overread in XvQueryImageAttributes crashes the server","description":"A buffer overread caused by casting a negative integer to CARD32 in XvQueryImageAttributes in X.Org X Server before 21.1.26 and xwayland before 24.1.15 could be used to causes crashes by authenticated X clients.","summary":"A negative integer cast to CARD32 in XvQueryImageAttributes causes a buffer overread in X.Org X Server before 21.1.26 and Xwayland before 24.1.15. An authenticated X client can use it to crash the server.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","infrastructure","linux","x.org","xwayland"],"not_affected_if":["no-x-clients","wayland-only"],"how_to_check":"- Run `Xorg -version` or `X -version` and compare against `21.1.26`.\n- For Xwayland, run `Xwayland -version` and compare against `24.1.15`.","fix":"- X.Org X Server: move to `21.1.26` or later.\n- Xwayland: move to `24.1.15` or later.","status":"open","published_at":"2026-11-13T11:17:14+00:00","first_seen_at":"2026-11-13T11:44:16+00:00","triaged_at":"2026-11-13T11:44:31+00:00","updated_at":"2026-11-13T11:44:31+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-13T11:44:31Z","model":"claude-haiku-5-5","output":{"fix":"- X.Org X Server: move to `21.1.26` or later.\n- Xwayland: move to `24.1.15` or later.","reach":"local","title":"X.Org X Server: buffer overread in XvQueryImageAttributes crashes the server","impact":"low","summary":"A negative integer cast to CARD32 in XvQueryImageAttributes causes a buffer overread in X.Org X Server before 21.1.26 and Xwayland before 24.1.15. An authenticated X client can use it to crash the server.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["x.org","xwayland","linux","desktop"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated X client crashes the X server","analyst_note":"","how_to_check":"- Run `Xorg -version` or `X -version` and compare against `21.1.26`.\n- For Xwayland, run `Xwayland -version` and compare against `24.1.15`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-x-clients","wayland-only"],"who_is_affected":"Systems running X.Org X Server before 21.1.26 or Xwayland before 24.1.15 are exposed. The flaw needs an authenticated X client, so hosts where only trusted local users have X access carry less risk. Desktop and Linux workstation fleets are the main places to look.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000719,"input_tokens":4540,"output_tokens":530,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-109903':13A,16A '-2026':12A,15A '21.1.26':39B,73C '24.1.15':43B,77C 'authent':45B,85C 'buffer':4A,32B,56C 'card32':27B,65C 'cast':25B,60C 'caus':30B,58C,82C 'client':47B,87C 'could':78C 'crash':8A,52B,83C 'cve':11A,14A 'desktop':17B 'infrastructur':18B 'integ':24B,63C 'linux':19B 'negat':23B,62C 'overread':5A,33B,57C 'server':3A,10A,37B,54B,71C 'use':49B,80C 'x':2A,36B,46B,70C,86C 'x.org':1A,20B,35B,69C 'xvqueryimageattribut':7A,29B,67C 'xwayland':21B,41B,75C","nicknames":[],"mitigations":[],"who_affected":"Systems running X.Org X Server before 21.1.26 or Xwayland before 24.1.15 are exposed. The flaw needs an authenticated X client, so hosts where only trusted local users have X access carry less risk. Desktop and Linux workstation fleets are the main places to look.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["desktop","high","infrastructure","linux","xorg","xwayland"],"campaign_type":null,"search_a":"'-109903':13A,16A '-2026':12A,15A 'buffer':4A 'crash':8A 'cve':11A,14A 'overread':5A 'server':3A,10A 'x':2A 'x.org':1A 'xvqueryimageattribut':7A","search_b":"'21.1.26':39B '24.1.15':43B 'authent':45B 'buffer':32B 'card32':27B 'cast':25B 'caus':30B 'client':47B 'crash':52B 'desktop':17B 'infrastructur':18B 'integ':24B 'linux':19B 'negat':23B 'overread':33B 'server':37B,54B 'use':49B 'x':36B,46B 'x.org':20B,35B 'xvqueryimageattribut':29B 'xwayland':21B,41B","search_c":"'21.1.26':73C '24.1.15':77C 'authent':85C 'buffer':56C 'card32':65C 'cast':60C 'caus':58C,82C 'client':87C 'could':78C 'crash':83C 'integ':63C 'negat':62C 'overread':57C 'server':71C 'use':80C 'x':70C,86C 'x.org':69C 'xvqueryimageattribut':67C 'xwayland':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T11:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"meissner@suse.de","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109903","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109903","severity":null,"published_at":"2026-11-13T11:17:14+00:00","modified_at":"2026-11-13T11:17:15+00:00","first_seen_at":"2026-11-13T11:44:16+00:00","fetched_at":"2026-11-13T11:44:16+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}