X.Org Server and Xwayland: Heap buffer overflow in GLX RenderLarge handling
Summary
A heap buffer overflow in the GLX RenderLarge request handling of the X.Org X server and Xwayland allows a local attacker to crash the X server or execute code in its context. The attacker needs an authenticated local X client with an active session on the display server. Headless servers without a graphical session are not exposed. The CVSS 4.0 score is 8.5 (High), but the attack vector is local and no public proof of concept or confirmed exploitation was found.
Affected
- xorg-x11-server (X.Org Server) before 21.1.25
- Xwayland before 24.1.14
Fixed in
- xorg-x11-server 21.1.25
- Xwayland 24.1.14
- Backported fixes may appear under distribution-specific package versions; check your distribution's advisory.
Workaround
No vendor-documented workaround. Patching is the recommended fix.
Reduce exposure by limiting local sessions on shared hosts and by not running X or Xwayland on headless servers.
Exploitation
- No public proof of concept found.
- No evidence of exploitation in the wild; not listed in the CISA KEV catalogue.
- The finder is listed as Anonymous working with ZDI (ZDI-CAN-31833).
Our recommendation
- Update xorg-server and Xwayland through your Linux distribution, starting with multi-user desktops and jump hosts.
- Patch CVE-2026-93517 together with the other X.Org flaws fixed in the same release.
- Headless servers can be patched in the normal update cycle.
- Check the NVD and CNA records for the CWE and publication date, as they differ between sources.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- X.Org Security Advisories www.x.org
- Fix commit (GitLab) gitlab.freedesktop.org
- Red Hat CVE page access.redhat.com
- Red Hat erratum RHSA-2026:86907 access.redhat.com
- GamingOnLinux release report www.gamingonlinux.com
- OffSeq threat page radar.offseq.com
- OpenCVE entry app.opencve.io
- Strix CVE mirror www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:54.
Original description (NVD)
A heap buffer overflow in handling GLX RenderLarge request where dataBytes exceeds cmdlen in X.org X server before 21.1.25 and XWayland before 24.1.14 that could be be triggered by an authenticated X client could cause crashes or code execution in X server context.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.