X.Org X Server: Heap buffer overflow in RandR ChangeProviderProperty
Summary
A heap buffer overflow in the RandR ChangeProviderProperty handling of X.Org X Server and XWayland allows an authenticated local X client to crash the X server or possibly execute code in its context. The CVSS vector requires local access and a low-privilege account, so remote exploitation from the internet is not expected. Multi-user Linux systems and shared X displays are the most exposed.
Affected
- xorg-x11-server (X.Org X Server) before 21.1.25
- XWayland before 24.1.14
- The CVE text names 2.1.25 and 24.4.14; these appear to be typos, as the fixed versions are 21.1.25 and 24.1.14.
Fixed in
- X.Org X Server 21.1.25
- XWayland 24.1.14
- Distribution packages: install the vendor update (e.g. SUSE bsc#1281238, Red Hat RHSA-2026:86907) or a vendor backport.
Workaround
- No vendor workaround known. Patching is the fix.
- Limit local shell and X display access to trusted users only.
Exploitation
- No evidence of exploitation in the wild found at the time of research; recheck CISA KEV.
- No public proof of concept found.
- EPSS: 0.2 % (percentile 10).
Our recommendation
- Inventory Linux hosts with X.Org or XWayland installed and identify multi-user or shared systems.
- Install the distribution update containing X.Org X Server 21.1.25 or XWayland 24.1.14, prioritising shared and multi-user systems.
- Recheck once NVD analysis and the X.Org advisory text are final.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fix commit (X.Org xserver) gitlab.freedesktop.org
- Red Hat CVE record access.redhat.com
- X.Org Security Advisories www.x.org
- SUSE advisory SUSE-2026-4645-1 linuxsecurity.com
- Red Hat erratum RHSA-2026:86907 access.redhat.com
- GamingOnLinux: X.Org Server 21.1.25 and XWayland 24.1.14 released www.gamingonlinux.com
- Help Net Security: X.Org Server fixed vulnerabilities www.helpnetsecurity.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:51.
Original description (NVD)
A buffer overflow in RandR ChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14 could be used by authenticated X clients to crash or execute code within the X server context.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.