X.Org Server and Xwayland receive security updates fixing twelve software flaws

Maintainers of the X.Org display architecture have published updates addressing a collection of 12 security weaknesses found in the core X server and its Wayland integration component, Xwayland. The patches arrive in release versions 21.1.25 of the standalone server package and 24.1.14 of Xwayland.

The problems were uncovered by the TrendAI Zero Day Initiative, which utilized artificial intelligence tools during its security audit. The disclosures continue a long history of memory management challenges in the decades-old graphics infrastructure.

Almost all of the discovered defects span both implementations. Eleven vulnerabilities touch the shared codebase used by both the conventional server and Xwayland. Only a single flaw, identified as CVE-2026-93522, is isolated to Xwayland, where a heap buffer overflow exists inside the Glamor rendering module on systems with graphics hardware acceleration.

The severity of the defects varies, though most present severe risks. Nine of the 12 issues give attackers a path toward running arbitrary programming code on an affected machine. The remaining three allow attackers either to crash the display service entirely or read unintended information from memory.

Access requirements also distinguish the reports. For 10 of the items, an attacker must operate through an authenticated client application that the server already permits to connect. The technical advisories for two entries, CVE-2026-93524 and CVE-2026-93536, omit that precondition.

The root causes consist overwhelmingly of standard memory safety oversights. Seven vulnerabilities involve buffer overflows or out-of-bounds writing operations, three stem from using memory after it has been freed, one involves releasing the same memory allocation twice, and one allows reading beyond buffer limits.

Certain bugs require specific features to manifest, though systems often run them out of the box. One use-after-free defect requires the Present and SYNC extensions, both activated by default. Another overflow occurs within pointer barrier event processing, triggering only when systems employ the XFixes and XTest modules alongside more than 100 active barrier markers.

Two of the flaws surfaced because earlier remediation work remained unfinished. One out-of-bounds write derived from an incomplete previous patch commit, while another repeated an old buffer overflow flaw in the RandR display subsystem where the fix had reached the output logic but had been overlooked in the provider routines.

System administrators and desktop users running Linux or Unix distributions are advised to verify their package versions against the newly released numbers to ensure the repairs are present.