Live › vulnerability › CVE-2026-93515
Go to dashboardA use-after-free in present_clear_window_notifies() in the X.org X Server before 21.1.25 and X Wayland before 24.1.14 lets a malicious X client crash the server. The sources also say it could potentially execute code in the X server context.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 13:33 UTC. All times on this page are UTC.
Systems running the X.org X Server before 21.1.25 or Xwayland before 24.1.14, where a local or remote X client can connect to the server. Systems that only run Wayland without Xwayland, or that do not accept X client connections from untrusted sources, are less exposed. The sources do not say which distributions or default configurations are affected.
No product ranges from the sources yet.
Xorg -version or X -version to read the installed X.org X Server versionXwayland -version21.1.25 or later24.1.14 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A use-after-free in present_clear_window_notifies() in the X.org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by malicious X clients to crash or potentially execute code in the X server context.
This page as .md · .json · in your agent: get_signal("CVE-2026-93515")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.