X.Org Server Patches Eight Vulnerabilities, Including Critical Monitor-Based Flaw
X.Org has released updates for its X server and Xwayland, addressing eight vulnerabilities, one of which allows a malicious monitor to corrupt server memory.
X.Org has released version 21.1.26 of its X server and 24.1.15 of Xwayland, patching a total of eight security vulnerabilities. These updates address critical issues that could lead to memory corruption, server crashes, and potential information disclosure within the display server software used by many Linux and Unix graphical desktop environments.
The X server is a fundamental component providing the low-level display layer for graphical interfaces on numerous Linux and Unix systems. Xwayland, which enables X11 applications to run on Wayland-based desktops, also incorporates these fixes, extending protection to Wayland users running older applications. The vulnerabilities can manifest as server crashes, memory corruption, unauthorized memory access, or memory content leakage.
A particularly concerning flaw, CVE-2026-109091, resides in the code responsible for reading Extended Display Identification Data (EDID) from connected monitors. The Xorg server copies this monitor description data into fixed-size arrays without adequately checking the size against the array limits. A specially crafted EDID, potentially delivered via a malicious monitor, can cause excess data to spill into adjacent memory regions, leading to memory corruption or server crashes.
Exploiting CVE-2026-109091 requires direct physical or network access to a server with a compromised monitor or a manipulated EDID. The remaining seven vulnerabilities are located within the code that handles X protocol requests, the communication messages sent between applications and the X server.
Four of these seven flaws are found in the X Video (Xv) extension, used for video frame processing. These include issues like CVE-2026-109092, where a negative size combined with a crafted offset can bypass bounds checks, allowing out-of-bounds reads or writes in shared memory. CVE-2026-109095, within the glamor acceleration code, can lead to incorrect image size calculations due to integer wrapping, potentially causing the server to read beyond the provided data.
CVE-2026-109096 and CVE-2026-109903 both stem from negative image sizes. One allows a request without image data to pass length checks, while the other reports an incorrect size to the client, which might then allocate or use buffers of the wrong size. CVE-2026-109093, an out-of-bounds stack write in the XTest extension, occurs because input values are copied to a fixed-size stack array before validation. The final two vulnerabilities, CVE-2026-109904 and CVE-2026-109094, are integer overflows in the X-Resource extension, which on 32-bit servers can cause a short request to pass length checks, leading to out-of-bounds reads or buffer walks.
X.Org has not provided official severity ratings or CVSS scores for these vulnerabilities, leaving administrators to assess their impact. However, the three flaws that permit out-of-bounds writes (CVE-2026-109091, CVE-2026-109092, and CVE-2026-109093) are considered the most critical and warrant immediate attention.
This release follows closely on the heels of a previous update in October that patched 12 other vulnerabilities. Users are advised to update their X.Org server and Xwayland packages promptly. Distributions are expected to backport these patches into their respective package versions, and users should consult their distribution's advisories for specific guidance.
This advisory details a heap-based buffer overflow vulnerability within the X.Org Server's doListFontsWithInfo function, specifically affecting local privilege escalation. Unlike the previously reported monitor-based memory corruption flaw, this new vulnerability requires an attacker to first gain low-privileged code execution on the target system before they can exploit it to escalate privileges to root.