X.Org Server/Xwayland: Heap buffer overflow in Glamor CopyArea
Summary
A heap buffer overflow in the Glamor CopyArea CPU-to-FBO path of X.Org Server and Xwayland allows an authenticated X client to crash the X server or potentially execute code in its context. The flaw is triggered by a CopyArea operation with mismatched sizes on a system using GPU acceleration. Exploitation requires that the attacker already has low-privileged local code execution, so the issue is not remotely exploitable. The Zero Day Initiative reports that the advisory claims code execution in root context, but the vendor/CNA text only says the code may be executed; the root claim is unverified.
Affected
- Xwayland: 9 to before 24.1.14 (CNA record)
- X.Org Server (xorg-x11-server): before 21.1.25 according to the CNA record; Help Net Security and LinuxSecurity list only Xwayland, so the X.Org Server status is unresolved
- The CVE text states 'before 21.1.15' for X.Org Server; this does not match the fix release and could not be verified
Fixed in
- Xwayland 24.1.14
- X.Org Server 21.1.25 (released October 7, 2026)
- Fix commit: ad26c26bf795e6464f74c8ef5bb1d41403d877ab
Workaround
- No vendor-documented workaround.
- On shared multi-user systems, limit Xwayland use where X11 applications are not needed (own suggestion, not from a source).
Exploitation
- No evidence of exploitation in the wild; not listed in CISA KEV.
- No public PoC detected (TheHackerWire); this has not been verified by searching GitHub or Exploit-DB.
- Reported by the Zero Day Initiative (ZDI-CAN-32361, ZDI-26-767); publicly released October 15, 2026.
Our recommendation
- Update Xwayland to 24.1.14 or a distribution build containing the fix, and X.Org Server to 21.1.25 or the fixed distribution package.
- Prioritise shared Linux hosts and terminal servers with graphical sessions; medium priority for typical Linux workstations.
- Check your distribution's security tracker, for example Red Hat RHSA-2026:85191 for RHEL 10.
- Windows and macOS systems are not affected.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- X.Org Security Advisories www.x.org
- Zero Day Initiative ZDI-26-767 www.zerodayinitiative.com
- Fix commit (GitLab xserver) gitlab.freedesktop.org
- Red Hat RHSA-2026:85191 access.redhat.com
- Help Net Security: X.Org server fixed vulnerabilities www.helpnetsecurity.com
- Phoronix: X.Org 12 new issues www.phoronix.com
- GamingOnLinux: xorg-server 21.1.25 and Xwayland 24.1.14 released www.gamingonlinux.com
- LinuxSecurity: Xorg/Xwayland security fixes linuxsecurity.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:52.
Original description (NVD)
A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in the X server context.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.