X.org vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-93523 A heap buffer overflow caused by a XIPassiveUngrabDevice request with an out-of-range modifier value in X.Org X Server before 21.1.15 and XWayland before 24.1.1High 7.8 · Oct 28, 2026
• CVE-2026-93522 A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used byHigh 7.8 · Oct 28, 2026
• CVE-2026-93521 A buffer overflow in RandR ChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14 could be used by authenticated X clients High 7.8 · Oct 28, 2026
• CVE-2026-93520 A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange in X.org X server before 2.1.25 and XWayland beforeHigh 7.8 · Oct 28, 2026
• CVE-2026-93519 A buffer overflow when handling pointer barriers in the XFIXES extension in X.Org X server before 21.1.25 and XWayland before 24.1.14 could be used by authenticHigh 7.8 · Oct 28, 2026
• CVE-2026-93518 An integer truncation issue in XkbResizeKeyType() that could lead to a heap buffer overflow by authenticated X clients in X.org X server before 21.1.25 and XWayHigh 7.8 · Oct 28, 2026
• CVE-2026-88812 A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a crash or potentially High 7.8 · Oct 27, 2026
• CVE-2026-109090 A malicious X server could cause a heap overflow by injecting a large DEVICE_ENABLE reply when processed by libXi before 1.8.4.High 7.5 · Oct 27, 2026
• CVE-2026-109089 A buffer overflow when handling DEVICE_RESOLUTION in libXi before 1.8.4 could overflow a heap, triggered by a malicious X server.High 7.5 · Oct 27, 2026
• CVE-2026-94286 An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients.High 7.1 · Sep 28, 2026
• CVE-2026-93543 An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.High 7.4 · Sep 24, 2026
• CVE-2026-88807 A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients.High 8.9 · Sep 21, 2026
• CVE-2026-88806 A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map.High 7.5 · Sep 21, 2026
• CVE-2026-56003 A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2 ComputeScaledProperties() before libXfont2 beforeHigh 8.5 · Jul 8, 2026
• CVE-2026-56002 A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8  allows attackers authenticated as X client to execute code wiHigh 8.5 · Jul 8, 2026
• CVE-2026-56001 A heap buffer overflow in BitmapScaleBitmaps in libXfont2 before 2.0.8 due to an overflowing 32bit size could be used by attackers able to access the X Server tHigh 8.5 · Jul 8, 2026
• CVE-2026-56000 Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a Heap Use AftCritical 9 · Jul 8, 2026
• CVE-2026-55999 Local attackers with a X connection able to provide PCX fonts to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a heap bufferHigh 8.5 · Jul 8, 2026
• CVE-2025-62230 A flaw was discovered in the X.Org X server’s X Keyboard (Xkb) extension when handling client resource cleanup.High 7.3 · Oct 30, 2025
• CVE-2025-62229 A flaw was found in the X.Org X server and Xwayland when processing X11 Present extension notifications.High 7.3 · Oct 30, 2025
• CVE-2025-62231 A flaw was identified in the X.Org X server’s X Keyboard (Xkb) extension where improper bounds checking in the XkbSetCompatMap() function can cause an unsigned High 7.3 · Oct 30, 2025
• CVE-2025-49180 A flaw was found in the RandR extension, where the RRChangeProviderProperty function does not properly validate input.High 7.8 · Jun 17, 2025
• CVE-2025-49179 A flaw was found in the X Record extension.High 7.3 · Jun 17, 2025
• CVE-2025-49176 A flaw was found in the Big Requests extension.High 7.3 · Jun 17, 2025
• CVE-2022-49737 In X.Org X server 20.11 through 21.1.16, when a client application uses easystroke for mouse gestures, the main thread modifies various data structures used by High 7.7 · Mar 15, 2025