CVE-2026-88812

A use-after-free caused by lack of lifecycle management when adding or removing XInput master devices exists in X.org X Server before 21.1.25 and XWayland before 24.1.14. An authenticated X client could exploit this to crash the X server or potentially execute code in the X server context.

A use-after-free in present_clear_window_notifies() in X.org X Server before 21.1.25 and XWayland before 24.1.14 could be exploited by malicious X clients to crash the server or potentially execute code in the X server context.

In the X.Org X server before 2017-06-19, a user authenticated to an X Session could crash or execute code in the context of the X Server by exploiting a stack overflow in the endianness conversion of X Events.

A use-after-free caused by missing lifecycle management of gesture sprites in GestureBuildSprite() exists in X.Org X Server before 21.1.25 and XWayland before 24.1.14. An authenticated X client could exploit it to crash the X server or potentially execute code.

A buffer overread in CheckKeySyms() exists in X.Org X Server before 21.1.25 and XWayland before 24.1.14. An authenticated X client could exploit it to leak small amounts of information from X server memory or potentially crash the X server.

A heap buffer overflow in X.Org X Server before 21.1.15 and XWayland before 24.1.14 is triggered by an XIPassiveUngrabDevice request with an out-of-range modifier value. An authenticated X client could exploit this to crash the X server or potentially execute code in the server context.

A heap buffer overflow caused by mismatched size usage in the CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14. Authenticated X clients could use it to crash the server or potentially execute code in the X server context.

A buffer overflow in RandR ChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14. Authenticated X clients could use it to crash the server or execute code within the X server context.

A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange exists in X.org X server before 2.1.25 and XWayland before 24.1.14. Authenticated X clients could exploit it to crash or potentially execute code in the X server context.

A buffer overflow when handling pointer barriers in the XFIXES extension exists in X.Org X server before 21.1.25 and XWayland before 24.1.14. Authenticated X clients could exploit it to crash or potentially execute code in the X server context.