# X.org XWayland vulnerabilities Source: https://junglewise.ai/threats/technologies/x-org-xwayland Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/x-org-xwayland.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 10 vulnerabilities in X.org XWayland: 0 in the last 7 days and 10 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-93536, was published on 28 October 2026. 10 vulnerabilities in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 10 - Last 90 days: 10 - All time: 10 (0 critical, 0 exploited in the wild) ## About X.org XWayland Server implementing the Wayland display protocol for X11 applications on Linux. ## Latest X.org XWayland vulnerabilities - [CVE-2026-93536: X.Org X Server use after free in gesture sprite lifecycle](https://junglewise.ai/threats/cve-2026-93536-a-use-after-free-caused-by-missing-lifecycle-management-of) (medium, CVSS 5.3, published 28 Oct 2026) - [CVE-2026-93524: X.Org X Server buffer overread in CheckKeySyms](https://junglewise.ai/threats/cve-2026-93524-a-buffer-overread-in-checkkeysyms-in-x-org-x-server-before-21-1) (info, published 28 Oct 2026) - [CVE-2026-93523: X.Org X Server heap buffer overflow in XIPassiveUngrabDevice](https://junglewise.ai/threats/cve-2026-93523-a-heap-buffer-overflow-caused-by-a-xipassiveungrabdevice-request) (high, CVSS 7.8, published 28 Oct 2026) - [CVE-2026-93522: X.Org X Server heap buffer overflow in CopyArea CPU-to-FBO](https://junglewise.ai/threats/cve-2026-93522-a-heap-buffer-overflow-caused-by-mismatched-size-usage-in) (high, CVSS 7.8, published 28 Oct 2026) - [CVE-2026-93521: X.Org X Server buffer overflow in RandR ChangeProviderProperty](https://junglewise.ai/threats/cve-2026-93521-a-buffer-overflow-in-randr-changeproviderproperty-requests-in-x) (high, CVSS 7.8, published 28 Oct 2026) - [CVE-2026-93520: X.org X server heap buffer overflow in XkbAllocNames](https://junglewise.ai/threats/cve-2026-93520-a-heap-buffer-overflow-caused-by-mismatching-size-calculations) (high, CVSS 7.8, published 28 Oct 2026) - [CVE-2026-93519: X.Org X server buffer overflow in XFIXES pointer barriers](https://junglewise.ai/threats/cve-2026-93519-a-buffer-overflow-when-handling-pointer-barriers-in-the-xfixes) (high, CVSS 7.8, published 28 Oct 2026) - [CVE-2026-93518: X.org X server integer truncation in XkbResizeKeyType heap buffer overflow](https://junglewise.ai/threats/cve-2026-93518-an-integer-truncation-issue-in-xkbresizekeytype-that-could-lead) (high, CVSS 7.8, published 28 Oct 2026) - [CVE-2026-93517: X.org X server and XWayland heap buffer overflow in GLX RenderLarge](https://junglewise.ai/threats/cve-2026-93517-a-heap-buffer-overflow-in-handling-glx-renderlarge-request-where) (info, published 28 Oct 2026) - [CVE-2026-93516: X.org X Server use-after-free in XInput device lifecycle](https://junglewise.ai/threats/cve-2026-93516-a-use-after-free-caused-by-lack-of-lifecycle-management-when) (medium, CVSS 5.5, published 28 Oct 2026) ## Most severe X.org XWayland vulnerabilities - [CVE-2026-93523: X.Org X Server heap buffer overflow in XIPassiveUngrabDevice](https://junglewise.ai/threats/cve-2026-93523-a-heap-buffer-overflow-caused-by-a-xipassiveungrabdevice-request) (high, CVSS 7.8, published 28 Oct 2026) - [CVE-2026-93522: X.Org X Server heap buffer overflow in CopyArea CPU-to-FBO](https://junglewise.ai/threats/cve-2026-93522-a-heap-buffer-overflow-caused-by-mismatched-size-usage-in) (high, CVSS 7.8, published 28 Oct 2026) - [CVE-2026-93521: X.Org X Server buffer overflow in RandR ChangeProviderProperty](https://junglewise.ai/threats/cve-2026-93521-a-buffer-overflow-in-randr-changeproviderproperty-requests-in-x) (high, CVSS 7.8, published 28 Oct 2026) - [CVE-2026-93520: X.org X server heap buffer overflow in XkbAllocNames](https://junglewise.ai/threats/cve-2026-93520-a-heap-buffer-overflow-caused-by-mismatching-size-calculations) (high, CVSS 7.8, published 28 Oct 2026) - [CVE-2026-93519: X.Org X server buffer overflow in XFIXES pointer barriers](https://junglewise.ai/threats/cve-2026-93519-a-buffer-overflow-when-handling-pointer-barriers-in-the-xfixes) (high, CVSS 7.8, published 28 Oct 2026) - [CVE-2026-93518: X.org X server integer truncation in XkbResizeKeyType heap buffer overflow](https://junglewise.ai/threats/cve-2026-93518-an-integer-truncation-issue-in-xkbresizekeytype-that-could-lead) (high, CVSS 7.8, published 28 Oct 2026) - [CVE-2026-93516: X.org X Server use-after-free in XInput device lifecycle](https://junglewise.ai/threats/cve-2026-93516-a-use-after-free-caused-by-lack-of-lifecycle-management-when) (medium, CVSS 5.5, published 28 Oct 2026) - [CVE-2026-93536: X.Org X Server use after free in gesture sprite lifecycle](https://junglewise.ai/threats/cve-2026-93536-a-use-after-free-caused-by-missing-lifecycle-management-of) (medium, CVSS 5.3, published 28 Oct 2026) - [CVE-2026-93524: X.Org X Server buffer overread in CheckKeySyms](https://junglewise.ai/threats/cve-2026-93524-a-buffer-overread-in-checkkeysyms-in-x-org-x-server-before-21-1) (info, published 28 Oct 2026) - [CVE-2026-93517: X.org X server and XWayland heap buffer overflow in GLX RenderLarge](https://junglewise.ai/threats/cve-2026-93517-a-heap-buffer-overflow-in-handling-glx-renderlarge-request-where) (info, published 28 Oct 2026) ## Vulnerabilities per week 10 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 10 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other X.org technologies - [X.org X Server](https://junglewise.ai/threats/technologies/x-org-x-server): 11 vulnerabilities - [X.org libXi](https://junglewise.ai/threats/technologies/libxi): 7 vulnerabilities - [X.org libXfont2](https://junglewise.ai/threats/technologies/libxfont2): 5 vulnerabilities - [X.org Xorg-Server](https://junglewise.ai/threats/technologies/xorg-server): 5 vulnerabilities - [X.org libX11](https://junglewise.ai/threats/technologies/libx11): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "X.org XWayland vulnerabilities", https://junglewise.ai/threats/technologies/x-org-xwayland, 9 November 2026.