Red Hat Security AdvisoryRHSA-2026:84574
xorg-x11-server security update
Released 2026-10-19 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 9) xorg-x11-server-1.20.11-34.el9_8.5, xorg-x11-server-Xdmx-1.20.11-34.el9_8.5, xorg-x11-server-Xephyr-1.20.11-34.el9_8.5 +4
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) xorg-x11-server-devel-1.20.11-34.el9_8.5, xorg-x11-server-source-1.20.11-34.el9_8.5
Fixes 5 records
Priority LOW 38
A heap buffer overflow in handling GLX RenderLarge request where dataBytes exceeds cmdlen in X.org X server before 21.1.25 and XWayland before 24.1.14 that could be be triggered by an authenticated X client could cause c…
CVSS 4.0HIGH 8.5· Local · Low privileges · No interaction · EPSS 0.00193 · Published 2026-10-28 · Partial fix · 21.1.25, 24.1.14 CWE-122
Priority LOW 35
A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange in X.org X server before 2.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or…
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00202 · Published 2026-10-28 · Partial fix · 21.1.25, 24.1.14 CWE-122
Priority LOW 35
A buffer overflow when handling pointer barriers in the XFIXES extension in X.Org X server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X ser…
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00202 · Published 2026-10-28 · Partial fix · 21.1.25, 24.1.14 CWE-122
Priority LOW 35
An integer truncation issue in XkbResizeKeyType() that could lead to a heap buffer overflow by authenticated X clients in X.org X server before 21.1.25 and XWayland before 24.1.14 could be exploited for crashes or potent…
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00202 · Published 2026-10-28 · Partial fix · 21.1.25, 24.1.14 CWE-122
Priority LOW 24
A use-after-free caused by lack of lifecycle management when adding / removing XInput master devices in X.org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X Clients to crash the X se…
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00192 · Published 2026-10-28 · Partial fix · 21.1.25, 24.1.14 CWE-416