X.Org released fixes for eight security issues in X server code, with corrected versions in xorg-server 21.1.26 and Xwayland 24.1.15. Its November 10 advisory identifies earlier versions as affected.
The weaknesses have different triggers and consequences. CVE-2026-109091 involves malformed monitor identification data, or EDID, that can overflow internal arrays. CVE-2026-109093 concerns input-event handling that can overwrite stack memory.
Two XRes request-size flaws, CVE-2026-109904 and CVE-2026-109094, specifically involve integer overflow on 32-bit servers. The remaining issues affect shared-memory image bounds, image-size calculations, request-length validation and a reply containing an invalid buffer size.
Reported consequences include crashes, memory corruption and out-of-bounds reads. These descriptions do not establish that every issue enables remote code execution, and the announcement does not report active exploitation.
Administrators should install the corrected upstream releases or their distribution’s corresponding security updates. Check both X server and Xwayland packages where present; using a Wayland desktop does not establish whether its Xwayland package contains these fixes.
