Read the docs
TI-2026-82013 Aliases CVE-2026-93522GHSA-5h3m-pr22-58xf

X.Org Server Glamor CopyArea Heap Buffer Overflow

Priority LOW 35CWE-122Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 4 fixed, 3 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-122 and the CVSS impact.

Summary

CVE-2026-93522 is a heap buffer overflow (CWE-122) in the CopyArea CPU-to-FBO path of Glamor, caused by mismatched size usage in X.Org X Server before 21.1.15 and XWayland before 24.1.14. Authenticated X clients can use it to crash the server or potentially execute code in the X server context. The CVSS 3.1 base score is 7.8 (HIGH). Red Hat rates it Important.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Description from the CNA

A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in the X server context.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00202 10th percentileScored 2026-11-07
Fix Partial xorg-x11-server (x.org): 21.1.25xwayland (x.org): 24.1.14Red Hat: 2 advisoriesRed Hat: 4 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
x.orgxorg-x11-serverbefore 21.1.2521.1.25Patch availableCNA
x.orgxwayland9 to before 24.1.1424.1.14Patch availableCNA
  • xorg-x11-server Vendorx.org Affected before 21.1.25 Fixed in 21.1.25 Patch available CNA
  • xwayland Vendorx.org Affected 9 to before 24.1.14 Fixed in 24.1.14 Patch available CNA

Remediation

Update xorg-x11-server to 21.1.25 and xwayland to 24.1.14. Red Hat published fixes for RHEL 9 and RHEL 10 AppStream and CodeReady Linux Builder in RHSA-2026:85193 and RHSA-2026:85191, both released 2026-10-19. Red Hat lists no fix planned for Red Hat Enterprise Linux 6, 8 and 9.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

  • Fix · CNA xorg-x11-server (x.org) Fixed in 21.1.25
  • Fix · CNA xwayland (x.org) Fixed in 24.1.14

Red Hat 2 advisories

  • RHSA-2026:85193 Released 2026-10-19 · Red Hat rating Important
    xorg-x11-server-Xwayland security update
    • Red Hat Enterprise Linux AppStream (v. 9) xorg-x11-server-Xwayland-24.1.9-4.el9_8.4
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) xorg-x11-server-Xwayland-24.1.9-4.el9_8.4, xorg-x11-server-Xwayland-devel-24.1.9-4.el9_8.4
  • RHSA-2026:85191 Released 2026-10-19 · Red Hat rating Important
    xorg-x11-server-Xwayland security update
    • Red Hat Enterprise Linux AppStream (v. 10) xorg-x11-server-Xwayland-24.1.9-4.el10_2.4
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) xorg-x11-server-Xwayland-devel-24.1.9-4.el10_2.4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    x.org xorg-x11-server 21.1.25

    10 records Highest priority Priority LOW 10 LOW

    Other records, highest priority first

    • TI-2026-82016 Heap buffer overflow in X.Org X Server XInput2 request handlingPriority LOW 35
    • TI-2026-82007 Heap buffer overflow in X.Org X server XKB keycode range handlingPriority LOW 35
    • TI-2026-81998 Heap buffer overflow in X.Org Server XFIXES pointer barriersPriority LOW 35
    Show all 10 records →
  • Release ·

    x.org xwayland 24.1.14

    10 records Highest priority Priority LOW 10 LOW

    Other records, highest priority first

    • TI-2026-81987 Heap buffer overflow in X.Org Server GLX RenderLarge requestPriority LOW 38
    • TI-2026-82016 Heap buffer overflow in X.Org X Server XInput2 request handlingPriority LOW 35
    • TI-2026-82007 Heap buffer overflow in X.Org X server XKB keycode range handlingPriority LOW 35
    Show all 10 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 9AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:85191
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:85193
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:85191
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:85193
Not affected: 2 products
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-93522
  2. 2026-10-28 Alias added: GHSA-5h3m-pr22-58xf
  3. 2026-10-30 Priority changed: MEDIUM → LOW
  4. 2026-11-05 CISA SSVC decision points changed
  5. 2026-11-06 Affected versions changed · Red Hat
  6. 2026-11-07 Affected versions changed · Red Hat

References

Patch 1

  • TI-2022-25238 In X.Org X server 20.11 through 21.1.16, when a client application uses easystroke for… CVSS 3.1HIGH 7.7
  • TI-1999-00519 An X server's access control is disabled (e.g. CVSS 2.0HIGH 10.0
  • TI-2021-11657 LookupCol.c in X.Org X through X11R7.7 and libX11 before 1.7.1 might allow remote… CVSS 3.1CRITICAL 9.8
  • TI-2018-10465 An issue was discovered in libX11 through 1.6.5. CVSS 3.0CRITICAL 9.8
  • TI-2004-00826 Multiple vulnerabilities in libXpm for 6.8.1 and earlier, as used in XFree86 and other… CVSS 2.0HIGH 10.0
  • TI-2016-08240 Multiple integer overflows in libXpm before 3.5.12, when a program requests parsing XPM… CVSS 3.0CRITICAL 9.8
See all 206 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences