CVE-2026-93536

A use-after-free vulnerability exists in X.Org X Server (before 21.1.25) and XWayland (before 24.1.14) due to missing lifecycle management of gesture sprites in GestureBuildSprite(). An authenticated X client can trigger this by providing inputs that cause WindowGone() to fail in repairing touch ...