How do I check whether I am affected by CVE-2026-93521?

- Run `Xorg -version` or `X -version` and compare against `2.1.25` for X.Org Server and `24.4.14` for XWayland - Run `Xwayland -version` on Wayland sessions that use XWayland - unknown for other checks, since the sources do not name a configuration

What is the fix for CVE-2026-93521?

- Upgrade X.Org X Server to `2.1.25` or later - Upgrade XWayland to `24.4.14` or later - Install the fixed packages from your distribution once it ships them

Who is not affected by CVE-2026-93521?

Not affected if: headless-server, no-x-server.

Live › vulnerability › CVE-2026-93521

Go to dashboard

high7.8Infrastructure

X.Org X Server: RandR request overflow lets a client crash or run code

A buffer overflow in the RandR ChangeProviderProperty request in X.Org X Server before 2.1.25 and XWayland before 24.4.14 lets an authenticated X client crash the server or execute code in its context. The attacker needs only a connection to the X server as a client.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

7.8

high

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 28, 2026 UTC
Last modified: Oct 28, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-28 16:33 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: No.
Reachable from: local.
Worst case: Code runs in the X server context, which usually runs as root.
CVSS said: 7.8. The facts above say medium; we keep the sources' high until an analyst looks.

Who is affected

Systems running X.Org X Server before 2.1.25 or XWayland before 24.4.14, including Linux desktops and workstations with an X session. Hosts that run no X server or XWayland, such as headless servers, can skip it. The sources do not say whether a default configuration is affected beyond running the server.

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-93521

Go to dashboard

high7.8Infrastructure

X.Org X Server: RandR request overflow lets a client crash or run code

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

7.8

high

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 28, 2026 UTC
Last modified: Oct 28, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-28 16:33 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: No.
Reachable from: local.
Worst case: Code runs in the X server context, which usually runs as root.
CVSS said: 7.8. The facts above say medium; we keep the sources' high until an analyst looks.

Who is affected

Know the next one before it finds you.

Add to Slack

X.Org X Server: RandR request overflow lets a client crash or run code

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

X.Org X Server: RandR request overflow lets a client crash or run code

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources