X.Org patches eight server vulnerabilities a month after fixing 12 others - Help Net Security

Entenda a falha

A vulnerabilidade

Eight memory-safety flaws affect the X.Org X server and Xwayland in all versions before xorg-server 21.1.26 and xwayland 24.1.15, which fix them. The three that can write out of bounds come first. CVE-2026-109091 is in the Xorg EDID parsing code and needs a malicious monitor or crafted EDID in front of the server. CVE-2026-109092 is in the Xv extension (XvShmPutImage) and CVE-2026-109093 is a stack write in XTest. The other five are Xv size flaws (CVE-2026-109095, -109096, -109903) and X-Resource integer overflows (CVE-2026-109904, -109094, 32-bit servers). Impact ranges from a crash to memory corruption, out-of-bounds reads and writes, and one memory leak. X.Org gave no CVSS scores and did not say whether code execution is possible.

Como funciona

For CVE-2026-109091, a monitor sends an EDID block describing its supported resolutions and refresh rates, and the Xorg server copies the display-range entries into fixed-size arrays. If the monitor reports more entries than the arrays hold, the excess spills into neighboring data. The other seven flaws are reached through X protocol requests that applications send. In Xv, a negative size or a 32-bit size calculation that wraps to a small value defeats the bounds or length check, so the server reads or writes outside the intended buffer or reports a bogus size to the client. In XTest, input values are copied into a fixed stack array before their size is checked. In X-Resource on 32-bit servers, a large count wraps so a short request passes the length check, and the server reads past the end of the request buffer.

Por que é vulnerável

The common root cause is missing or wrong size validation. In the EDID code the entry count is not checked against the array limits. In XTest the copy into the stack array happens before the fit check. In Xv, XvShmPutImage's bounds check can be wrapped by a negative size combined with a crafted offset, and glamor uses 32-bit integers that wrap for large images. In X-Resource, 32-bit counts overflow and the length check is defeated. The articles do not say why these went unnoticed or describe the code changes in the fixes.

Onde está

The article names the Xorg EDID parsing code, XvShmPutImage and the glamor acceleration code in the Xv extension, the XTest extension and the X-Resource extension, but gives no file names, functions or commits.

Como foi descoberta

The articles do not say who found the flaws or how. They report only that X.Org released xorg-server 21.1.26 and xwayland 24.1.15 with the fixes, about a month after 21.1.25 fixed 12 other flaws. X.Org published no severity ratings. Distributions usually backport the patches, so the CVE numbers should be looked up in the distribution's advisory.

Explicação gerada por IA a partir da matéria e dos artigos, em 10/11/2026 15:16.