Live › vulnerability › CVE-2026-93519
Go to dashboardA buffer overflow in the XFIXES extension's pointer barrier handling in X.Org X server (before 21.1.25) and XWayland (before 24.1.14) can be triggered by an authenticated X client. An attacker can crash the X server or potentially execute code in its context.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 15:33 UTC. All times on this page are UTC.
Systems running an X.Org X server older than 21.1.25 or XWayland older than 24.1.14 are exposed, since the flaw sits in the XFIXES extension that any X client can reach. Exposure requires a client that can connect to the X server, so multi-user desktops and hosts where untrusted local processes can reach the X display are the main concern. Headless hosts without an X server, and systems already on the fixed versions, can skip it.
No product ranges from the sources yet.
Xorg -version or X -version and compare against 21.1.25.Xwayland -version and compare against 24.1.14.21.1.25 or later.24.1.14 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A buffer overflow when handling pointer barriers in the XFIXES extension in X.Org X server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.
This page as .md · .json · in your agent: get_signal("CVE-2026-93519")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.