CVE-2026-93515

A use-after-free in presentclearwindownotifies in the X.org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by malicious X clients to crash or potentially execute code in the X server context...

CVE-2026-93515

A use-after-free in presentclearwindownotifies in the X.org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by malicious X clients to crash or potentially execute code in the X server context...

CVE-2026-93515

A use-after-free vulnerability exists in present_clear_window_notifies() within the X.org X Server (versions before 21.1.25 ) and X Wayland (versions before 24.1.14 ). The flaw occurs because notify entries are not unlinked from the per-window list before freeing window_priv. If a window is subse...

CVE-2026-93515 .Org Server Present Extension Use-After-Free

A use-after-free in presentclearwindownotifies in the X.org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by malicious X clients to crash or potentially execute code in the X server context...

EUVD-2026-112041

A use-after-free in presentclearwindownotifies in the X.org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by malicious X clients to crash or potentially execute code in the X server context...

Amazon Linux 2023 : xorg-x11-server-Xwayland, xorg-x11-server-Xwayland-devel (ALAS2023-2026-3261)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3261 advisory. CheckSetDoodad in xkb/xkb.c frees doodad-text.text on error but doesnot NULL the pointer. When the error path continues, XkbClearDoodad iscalled during cleanup and frees the same pointer again...

Amazon Linux 2023 : tigervnc, tigervnc-icons, tigervnc-license (ALAS2023-2026-3262)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3262 advisory. CheckSetDoodad in xkb/xkb.c frees doodad-text.text on error but doesnot NULL the pointer. When the error path continues, XkbClearDoodad iscalled during cleanup and frees the same pointer again...