EUVD-2026-125297

Incorrect handling of negative returns from ddQueryImageAttributes when processing XvPutImage requests in X.Org xwayland before 24.1.15 and X Server before 21.1.26 could be used by authenticated X clients to crash the X server...

CVE-2026-109096

A flaw in the X.Org Server 's XvPutImage length validation allows authenticated X clients to bypass size checks by exploiting incorrect handling of negative returns from ddQueryImageAttributes(). This vulnerability affects X.Org xwayland before version 24.1.15 and X Server before version 21.1.26 ...

CVE-2026-109096

Incorrect handling of negative returns from ddQueryImageAttributes when processing XvPutImage requests in X.Org xwayland before 24.1.15 and X Server before 21.1.26 could be used by authenticated X clients to crash the X server...