CVE-2026-109095

X.Org X server and Xwayland: glamorxvqueryimageattributes computes NV12/YV12 image sizes with 32-bit ints; large width/height values wrap to a small positive size, so protocol length checks accept PutImage/ShmPutImage requests lacking the claimed payload out-of-bounds read. Fixed in xorg-server...

X.org MIT-SHM extension arbitrary memory read

Integer overflow in the fbShmPutImage function in the MIT-SHM extension in the X server 1.4 in X.Org X11R7.3 allows context-dependent attackers to read arbitrary process memory via crafted values for a Pixmap width and height...