High severityNVD Advisory· Published Oct 28, 2026· Updated Oct 28, 2026
CVE-2026-93517
CVE-2026-93517
Description
A heap buffer overflow in handling GLX RenderLarge request where dataBytes exceeds cmdlen in X.org X server before 21.1.25 and XWayland before 24.1.14 that could be be triggered by an authenticated X client could cause crashes or code execution in X server context.
Affected products
14- osv-coords12 versionspkg:rpm/almalinux/xorg-x11-server-Xdmxpkg:rpm/almalinux/xorg-x11-server-Xephyrpkg:rpm/almalinux/xorg-x11-server-Xnestpkg:rpm/almalinux/xorg-x11-server-Xorgpkg:rpm/almalinux/xorg-x11-server-Xvfbpkg:rpm/almalinux/xorg-x11-server-Xwaylandpkg:rpm/almalinux/xorg-x11-server-Xwayland-develpkg:rpm/almalinux/xorg-x11-server-commonpkg:rpm/almalinux/xorg-x11-server-develpkg:rpm/almalinux/xorg-x11-server-sourcepkg:rpm/opensuse/xorg-x11-server&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/xwayland&distro=openSUSE%20Tumbleweed
< 1.20.11-34.el9_8.5+ 11 more
- (no CPE)range: < 1.20.11-34.el9_8.5
- (no CPE)range: < 1.20.11-34.el9_8.5
- (no CPE)range: < 1.20.11-34.el9_8.5
- (no CPE)range: < 1.20.11-34.el9_8.5
- (no CPE)range: < 1.20.11-34.el9_8.5
- (no CPE)range: < 24.1.9-4.el10_2.4
- (no CPE)range: < 24.1.9-4.el10_2.4
- (no CPE)range: < 1.20.11-34.el9_8.5
- (no CPE)range: < 1.20.11-34.el9_8.5
- (no CPE)range: < 1.20.11-34.el9_8.5
- (no CPE)range: < 21.1.24-2.1
- (no CPE)range: < 24.1.13-2.1
Patches
Vulnerability mechanics
References
1News mentions
1- ZDI-26-762: X.Org Server GLX RenderLarge Heap-based Buffer Overflow Privilege Escalation VulnerabilityZero Day Initiative · Oct 15, 2026