CVE-2026-93536

A use-after-free vulnerability exists in X.Org X Server (before 21.1.25) and XWayland (before 24.1.14) due to missing lifecycle management of gesture sprites in GestureBuildSprite(). An authenticated X client can trigger this by providing inputs that cause WindowGone() to fail in repairing touch ...

EUVD-2026-112225

A use after free caused by missing lifecycle management of gesture sprites in GestureBuildSprite in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash the X server or potentially execute code...

Linux Distros Unpatched Vulnerability : CVE-2026-93536

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GestureBuildSprite Use-After-Free CVE-2026-93536 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenable...

X.Org Server GestureBuildSprite Use-After-Free Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on affected installations of X.Org Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling...