Known Vulnerabilities for Xwayland by Xorg
Listed below are 10 of the newest known vulnerabilities associated with "Xwayland" by "Xorg".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-121604 json | wlroots before 0.20.2 contains an out-of-bounds read vulnerability in read_surface_class() in xwayland/xwm.c that allows loca... | Not Provided | 2026-11-03 | 2026-11-07 |
| CVE-2026-109904 json | A buffer overread caused by an integer-overflow in Proc/SProcXResQueryClientIds in X.Org xwayland before 24.1.15 and X Serve... | Not Provided | 2026-11-13 | 2026-11-13 |
| CVE-2026-109903 json | A buffer overread caused by casting a negative integer to CARD32 in XvQueryImageAttributes in X.Org X Server before 21.1.26 ... | Not Provided | 2026-11-13 | 2026-11-13 |
| CVE-2026-109096 json | Incorrect handling of negative returns from ddQueryImageAttributes() when processing XvPutImage requests in X.Org xwayland ... | Not Provided | 2026-11-13 | 2026-11-13 |
| CVE-2026-109095 json | A integer overflow in glamor Xv Image Size handling in X.Org xwayland before 24.1.15 and X server before 21.1.26 could be us... | Not Provided | 2026-11-13 | 2026-11-13 |
| CVE-2026-109094 json | A integer overflow that can lead to a buffer overrread in the XRes QueryResourceBytes Swap Path in the X.Org xwayland before... | Not Provided | 2026-11-13 | 2026-11-13 |
| CVE-2026-109093 json | A stack buffer overflow in ProcXTestFakeInput DeviceValuator handling in X.Org xwayland before 24.1.15 and X server before... | Not Provided | 2026-11-13 | 2026-11-13 |
| CVE-2026-109092 json | Incorrectly handled negative sizes when processing ProcXvShmPutImage requests in the X.Org xwayland before 24.1.15 and X Ser... | Not Provided | 2026-11-13 | 2026-11-13 |
| CVE-2026-109091 json | A buffer overflow in handling EDID Display-Range descriptors in X.Org xwayland before 24.1.15 and X Server before 21.1.26 co... | Not Provided | 2026-11-13 | 2026-11-13 |
| CVE-2026-93536 json | A use after free caused by missing lifecycle management of gesture sprites in GestureBuildSprite() in X.Org X Server before ... | Not Provided | 2026-10-28 | 2026-11-06 |