CVE-2026-93517：X.Org Server GLX RenderLarge Heap Buffer Overflow 漏洞
CVE-2026-93517 - X.Org Server GLX RenderLarge Heap Buffer Overflow
X.Org Server 與 XWayland 在處理 GLX RenderLarge 請求時，若 dataBytes 超過 cmdlen，已認證 X 客戶可觸發堆疊緩衝區溢位，造成伺服器崩潰或執行任意程式碼。
此漏洞可能被已認證 X 客戶利用，造成 X 伺服器崩潰或執行任意程式碼，影響圖形顯示與系統穩定。更新至 21.1.25 或 24.1.14 可修復，建議即時升級以避免潛在安全風險，確保圖形環境安全。
A heap buffer overflow in handling GLX RenderLarge request where dataBytes exceeds cmdlen in X.org X server before 21.1.25 and XWayland before 24.1.14 that could be be triggered by an authenticated X client could cause crashes or code execution in X server context.
Impact
Affected Products
The following products are affected by CVE-2026-93517
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
| ID | Vendor | Product | Action |
|---|---|---|---|
| 1 | X.org | xwayland | |
| 1 | X.orgg | xorg-x11-server |
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 4.0 | HIGH | 404e59f5-483d-4b8a-8e7a-e67604dd8afb |
Update X.org X server and XWayland to patch heap buffer overflow vulnerability.
- Update X.org X server to version 21.1.25 or later.
- Update XWayland to version 24.1.14 or later.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-93517 vulnerability anywhere in the article.
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.