Live › vulnerability › CVE-2026-93517
Go to dashboardA heap buffer overflow in the GLX RenderLarge request handling of the X.org X server and XWayland lets an authenticated X client crash the server or execute code in its context. Affected versions are X.org X server before 21.1.25 and XWayland before 24.1.14.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 14:33 UTC. All times on this page are UTC.
Systems running an X.org X server older than 21.1.25 or an XWayland older than 24.1.14, including desktop Linux and BSD sessions and Wayland compositors that spawn XWayland. Exposure needs an X client that can authenticate to the server, so single-user machines with no other X clients are at lower risk. Hosts that run no X server and no XWayland can skip it.
No product ranges from the sources yet.
Xorg -version or X -version and compare against 21.1.25Xwayland -version and compare against 24.1.14dpkg -l xserver-xorg-core or rpm -q xorg-x11-server-Xorg21.1.25 or later24.1.14 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A heap buffer overflow in handling GLX RenderLarge request where dataBytes exceeds cmdlen in X.org X server before 21.1.25 and XWayland before 24.1.14 that could be be triggered by an authenticated X client could cause crashes or code execution in X server context.
This page as .md · .json · in your agent: get_signal("CVE-2026-93517")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.