# CVE-2026-93517: X.org X server and XWayland heap buffer overflow in GLX RenderLarge

Source: https://junglewise.ai/threats/cve-2026-93517-a-heap-buffer-overflow-in-handling-glx-renderlarge-request-where  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-93517 · Severity: info · Published 2026-10-28

X.org X server and XWayland are display servers that manage graphics rendering for Linux and Unix systems. A heap buffer overflow in the GLX RenderLarge request handler allows an authenticated X client to cause crashes or execute arbitrary code with X server privileges by sending malformed graphics commands with mismatched size fields.

Technologies: [X.Org X Server](https://junglewise.ai/threats/technologies/x-org-x-server), [X.Org XWayland](https://junglewise.ai/threats/technologies/x-org-xwayland). Vendors: [X.Org](https://junglewise.ai/threats/vendors/x-org).

## Quick answers

**Is CVE-2026-93517 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-93517 being exploited in the wild.

**How severe is CVE-2026-93517?** Informational severity, published 28 October 2026.

**Which products and versions are affected?** X.Org X Server before 21.1.25; X.Org XWayland before 24.1.14.

**Is there a fix for CVE-2026-93517?** Yes: fixed in X server 21.1.25; XWayland 24.1.14. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-93517 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-93517?** Check whether you run X.Org X Server or X.Org XWayland at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in X server 21.1.25; XWayland 24.1.14

## Technical details

The __glXDisp_RenderLarge() function allocates a buffer based on cmdlen (from the GL command header) but copies dataBytes (from the X11 request payload) into it without validating that dataBytes does not exceed cmdlen. An authenticated attacker can craft a RenderLarge request with a small cmdlen (e.g., 12 bytes) and a large dataBytes (up to ~256KB with BIG-REQUESTS) to overflow the heap buffer. The fix adds validation that dataBytes ≤ cmdlen before buffer allocation and copying on the first request.

## Affected products

- X.org X server before 21.1.25
- X.org XWayland before 24.1.14

## Timeline

- 2026-10-28: disclosed
- 2026-08-26: patched: Commit 2abe4632d793314d3d5f28c19583fb76019f5ce4 in xorg/xserver

## References

- [https://gitlab.freedesktop.org/xorg/xserver/-/commit/2abe4632d793314d3d5f28c19583fb76019f5ce4](https://gitlab.freedesktop.org/xorg/xserver/-/commit/2abe4632d793314d3d5f28c19583fb76019f5ce4)

## Related threats

- [X.Org X Server use after free in gesture sprite lifecycle](https://junglewise.ai/threats/cve-2026-93536-a-use-after-free-caused-by-missing-lifecycle-management-of)
- [X.Org X Server buffer overread in CheckKeySyms](https://junglewise.ai/threats/cve-2026-93524-a-buffer-overread-in-checkkeysyms-in-x-org-x-server-before-21-1)
- [X.Org X Server heap buffer overflow in XIPassiveUngrabDevice](https://junglewise.ai/threats/cve-2026-93523-a-heap-buffer-overflow-caused-by-a-xipassiveungrabdevice-request)
- [X.Org X Server heap buffer overflow in CopyArea CPU-to-FBO](https://junglewise.ai/threats/cve-2026-93522-a-heap-buffer-overflow-caused-by-mismatched-size-usage-in)
- [X.Org X Server buffer overflow in RandR ChangeProviderProperty](https://junglewise.ai/threats/cve-2026-93521-a-buffer-overflow-in-randr-changeproviderproperty-requests-in-x)