High severity · published Oct 28, 2026
CVE-2026-93517
X.Org Server GLX RenderLarge Heap Buffer Overflow
New
8.5
CVSS
–
EPSS
No
On KEV
Description
A heap buffer overflow in handling GLX
RenderLarge request where dataBytes exceeds cmdlen in X.org X server before 21.1.25 and XWayland before 24.1.14 that could be be triggered by an authenticated X client could cause crashes or code execution in X server context.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
XO
xorg-x11-server · x.orgg
before 21.1.25 · source: vendor
XW
xwayland · x.org
before 24.1.14 · source: vendor
In the news
VulnerabilityHigh
ZDI-26-762: X.Org Server GLX RenderLarge Heap-based Buffer Overflow Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of X.Org Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-93517.
Oct 15, 2026·Zero Day Initiative
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-93517
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-93517
gitlab.freedesktop.org
https://gitlab.freedesktop.org/xorg/xserver/-/commit/2abe4632d793314d3d5f28c19583fb76019f5ce4
More from xwayland
9.8
CVE-2023-6816
A flaw was found in X.Org server
7.8
CVE-2026-93523
X.Org Server XInput2 PassiveUngrabDevice Out-of-Bounds Write
7.8
CVE-2026-93522
X.Org Server Glamor CopyArea Heap Buffer Overflow
7.8
CVE-2026-93521
X.Org Server RandR ChangeProviderProperty Heap Buffer Overflow
7.8
CVE-2026-93520
X.Org Server XKB ChangeKeycodeRange Heap Out-of-Bounds Write