X.Org fixes three server bugs that can crash or corrupt memory

X.Org has published fixes for three flaws in the X server and Xwayland that a crafted monitor description, shared-memory request, or fake input stream can use to crash the server or corrupt memory. The issues are fixed in xorg-server 21.1.26 and Xwayland 24.1.15, according to an advisory sent by Olivier Fourdan on November 10, 2026.

CVE-2026-109091 is an out-of-bounds write in how the server stores EDID display-range descriptors. Those values go into fixed-size arrays without a check against the maximum number of horizontal sync or vertical refresh entries. A malicious monitor, or a crafted EDID, can supply extra descriptors that overrun the arrays and overwrite neighboring monitor fields, crashing the server or corrupting memory. Eun0us, also known as Espilon, reported the bug.

CVE-2026-109092 is a bounds error in the Xv shared-memory PutImage path. The check adds a size and an offset and compares the sum to the shared-memory segment. A negative size from the device-dependent layer, combined with a crafted offset, wraps that addition so the check passes and an invalid pointer is handed to PutImage. The result is an out-of-bounds read or write in the server. Acts1631 reported it.

CVE-2026-109093 is a stack out-of-bounds write in XTest fake input. The server copies device valuator fields into a fixed stack array before checking that the valuator range fits. Enough valuator events write past that array, which can crash the server or corrupt memory.

Anyone running an older Xorg server or Xwayland should move to those releases. The EDID bug is reachable from display identification data, so a hostile or compromised monitor path is enough; the other two depend on clients that can issue the affected requests.