CVE-2018-14665

CVE-2018-14665 0x00 Introduction Indian security researcher Narendra Shinde discovered a high-risk vulnerability CVE-2018-14665 in the X.Org Server package that allows a regular account to escalate privileges to root. It affects major Linux distributions including OpenBSD, Debian, Ubuntu, CentOS,...

CVE-2026-109092 X.Org Server XvShmPutImage Shared-Memory Bounds Overflow

Incorrectly handled negative sizes when processing ProcXvShmPutImage requests in the X.Org xwayland before 24.1.15 and X Server before 21.1.26 could be used by local authenticated X clients to crash the X server or execute code...

CVE-2026-109092

The X.Org Server and X.Org xwayland (versions before 21.1.26 and 24.1.15 , respectively) are vulnerable to a shared-memory bounds overflow (CWE-191). The issue stems from the incorrect handling of negative sizes during the processing of ProcXvShmPutImage requests. A local authenticated X client c...

CVE-2026-109096

A flaw in the X.Org Server 's XvPutImage length validation allows authenticated X clients to bypass size checks by exploiting incorrect handling of negative returns from ddQueryImageAttributes(). This vulnerability affects X.Org xwayland before version 24.1.15 and X Server before version 21.1.26 ...

CVE-2026-109096 X.Org Server XvPutImage Negative Image Size Length Bypass

Incorrect handling of negative returns from ddQueryImageAttributes when processing XvPutImage requests in X.Org xwayland before 24.1.15 and X Server before 21.1.26 could be used by authenticated X clients to crash the X server...

CVE-2026-109904

A buffer overread caused by an integer-overflow in Proc/SProcXResQueryClientIds in X.Org xwayland before 24.1.15 and X Server before 21.1.26 could be used by attackers on authenticated X clients to crash the server or leak out information...

CVE-2026-109903

A buffer overread caused by casting a negative integer to CARD32 in XvQueryImageAttributes in X.Org X Server before 21.1.26 and xwayland before 24.1.15 could be used to causes crashes by authenticated X clients...

CVE-2026-109095

A integer overflow in glamor Xv Image Size handling in X.Org xwayland before 24.1.15 and X server before 21.1.26 could be used by authenticated clients to crash the X server or leak out data...

CVE-2026-109096

Incorrect handling of negative returns from ddQueryImageAttributes when processing XvPutImage requests in X.Org xwayland before 24.1.15 and X Server before 21.1.26 could be used by authenticated X clients to crash the X server...

CVE-2026-109093

A stack buffer overflow in ProcXTestFakeInput DeviceValuator handling in X.Org xwayland before 24.1.15 and X server before 21.1.26 could be used by authenticated clients to crash or execute code in the X server...

CVE-2026-109094

A integer overflow that can lead to a buffer overrread in the XRes QueryResourceBytes Swap Path in the X.Org xwayland before 24.1.15 and X Server before 21.1.26 on 32bit systems could be used by authenticated clients to crash the X server...

CVE-2026-109091

A buffer overflow in handling EDID Display-Range descriptors in X.Org xwayland before 24.1.15 and X Server before 21.1.26 could be used by malicious monitors to crash the x server or execute cote...

CVE-2026-109092

Incorrectly handled negative sizes when processing ProcXvShmPutImage requests in the X.Org xwayland before 24.1.15 and X Server before 21.1.26 could be used by local authenticated X clients to crash the X server or execute code...

X.Org Server libXrender RenderQueryPictFormats Reply Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of X.Org Server. User interaction is required to exploit this vulnerability in that the target must connect to a malicious X11 server. The specific flaw exists within the XRenderQueryFormats function. T...

X.Org Server Font Alias Resolution Heap-based Buffer Overflow Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of X.Org Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the doListFontsWithInfo...

X.Org Server XkbResizeKeySyms Integer Overflow Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of X.Org Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the XkbResizeKeySyms...

X.Org Server libX11 XkbGetMap Reply Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of X.Org Server. User interaction is required to exploit this vulnerability in that the target must connect to a malicious X11 server. The specific flaw exists within the XkbReadKeyActions function. The...

X.Org X server and Xwayland -- Multiple vulnerabilities

X.Org reports: CVE-2026-109091: X.Org Server EDID DSRANGES Out-Of-Bounds Write CVE-2026-109092: X.Org Server XvShmPutImage Shared-Memory Bounds Overflow CVE-2026-109093: X.Org Server XTestFakeInput Valuator Stack Out-Of-Bounds Write CVE-2026-109094: X.Org Server XRes QueryResourceBytes Swap Path...

Wayland Protocol Heap Buffer Overflow

The vulnerability in the CommonMakeCurrent function of the Wayland protocol implementation for X.Org XWayland and the X Window System X.Org Server implementation is related to memory usage after it has been freed. Exploitation of this vulnerability may allow a remote attacker to execute arbitrary...

Wayland glamor_font_get() Code Execution

The vulnerability in the Wayland implementation of glamorfontget for X.Org XWayland and the X Window System X.Org Server implementation is related to a buffer overflow in dynamic memory. Exploitation of this vulnerability may allow an attacker to execute arbitrary code...