X.Org Server and Xwayland Patch 12 Flaws, Including Nine Code-Execution Vulnerabilities

X.Org patched 12 security vulnerabilities in X.Org Server and Xwayland, releasing fixes in xorg-server 21.1.25 and Xwayland 24.1.14. Discovered by TrendAI’s Zero Day Initiative with AI assistance, the flaws include double-free, use-after-free, buffer-overflow, numeric-truncation and out-of-bounds memory-access issues. Nine can lead to arbitrary code execution; the remaining three can crash the server or disclose information. Two fixes address incomplete earlier remediation.

Eleven vulnerabilities affect both products, while CVE-2026-93522 affects only Xwayland’s GPU-accelerated Glamor CopyArea code. Ten vulnerability entries explicitly require an authenticated X client; the entries for CVE-2026-93524 and CVE-2026-93536 do not specify that condition, which does not establish unauthenticated exploitability. Administrators should inventory affected installations, compare installed versions with the patched releases and prioritize updates, particularly where untrusted clients can access the X server.