{"id":"CVE-2026-93522","kind":"vulnerability","aliases":["CVE-2026-93522"],"related":[],"title":"X.Org X Server: CopyArea heap overflow lets clients crash or run code","description":"A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in the X server context.","summary":"A size mismatch in the CopyArea CPU-to-FBO path of X.Org X Server and XWayland causes a heap buffer overflow. An authenticated X client can crash the server or potentially execute code in the X server context.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-desktop","runtime","self-hosted","x11","xwayland"],"not_affected_if":["fixed-version","no-x-server"],"how_to_check":"- `Xorg -version` or `X -version` to read the installed X.Org server version\n- `Xwayland -version` to read the installed XWayland version\n- Check whether the server is older than `21.1.15` (X.Org) or `24.1.14` (XWayland)","fix":"- Upgrade the X.Org X Server to `21.1.15` or later\n- Upgrade XWayland to `24.1.14` or later\n- Install the fixed build from your distribution's package manager","status":"open","published_at":"2026-10-28T16:17:10+00:00","first_seen_at":"2026-10-28T16:33:49+00:00","triaged_at":"2026-10-28T16:35:49+00:00","updated_at":"2026-10-28T16:35:49+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-28T16:35:49Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the X.Org X Server to `21.1.15` or later\n- Upgrade XWayland to `24.1.14` or later\n- Install the fixed build from your distribution's package manager","reach":"local","title":"X.Org X Server: CopyArea heap overflow lets clients crash or run code","impact":"high","summary":"A size mismatch in the CopyArea CPU-to-FBO path of X.Org X Server and XWayland causes a heap buffer overflow. An authenticated X client can crash the server or potentially execute code in the X server context.","category":"runtime","nicknames":[],"who_cares":["linux-desktop","x11","xwayland","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Code runs in the X server context, or the server crashes","analyst_note":"Check the X.Org security advisory and distro trackers for the exact fixed package versions and whether remote X access is reachable.","how_to_check":"- `Xorg -version` or `X -version` to read the installed X.Org server version\n- `Xwayland -version` to read the installed XWayland version\n- Check whether the server is older than `21.1.15` (X.Org) or `24.1.14` (XWayland)","needs_analyst":true,"not_affected_if":["no-x-server","fixed-version"],"who_is_affected":"Systems running an X.Org X Server older than `21.1.15` or XWayland older than `24.1.14`. The sources say the attacker must be an authenticated X client, so any machine where local or remote users can open X connections is in scope. Systems without an X server, or that run only on a fixed version, are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000631,"input_tokens":3321,"output_tokens":598,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-93522':15A,18A '21.1.15':88C '24.1.14':92C 'authent':51B,97C 'buffer':48B,69C 'caus':45B,71C 'client':8A,53B,99C 'code':12A,61B,105C 'context':66B,110C 'copyarea':4A,33B,77C 'could':93C 'cpu':35B,79C 'cpu-to-fbo':34B,78C 'crash':9A,55B,101C 'cve':13A,16A 'desktop':21B 'execut':60B,104C 'fbo':37B,81C 'heap':5A,47B,68C 'host':25B 'let':7A 'linux':20B 'linux-desktop':19B 'mismatch':30B,73C 'overflow':6A,49B,70C 'path':38B,82C 'potenti':59B,103C 'run':11A 'runtim':22B 'self':24B 'self-host':23B 'server':3A,42B,57B,65B,86C,109C 'size':29B,74C 'usag':75C 'use':95C 'x':2A,41B,52B,64B,85C,98C,108C 'x.org':1A,40B,84C 'x11':26B 'xwayland':27B,44B,90C","nicknames":[],"mitigations":[],"who_affected":"Systems running an X.Org X Server older than `21.1.15` or XWayland older than `24.1.14`. The sources say the attacker must be an authenticated X client, so any machine where local or remote users can open X connections is in scope. Systems without an X server, or that run only on a fixed version, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T16:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"meissner@suse.de","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93522","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93522","severity":null,"published_at":"2026-10-28T16:17:10+00:00","modified_at":"2026-10-28T16:17:10+00:00","first_seen_at":"2026-10-28T16:33:49+00:00","fetched_at":"2026-10-28T16:33:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}