# Freedesktop.org vulnerabilities Source: https://junglewise.ai/threats/vendors/freedesktop-org Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 10 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/freedesktop-org.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 12 vulnerabilities in Freedesktop.org: 0 in the last 7 days and 4 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-120831, was published on 3 November 2026. 2 vulnerabilities in the last four weeks, level on the four before (2). 2 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 2 - Last 90 days: 4 - All time: 12 (0 critical, 0 exploited in the wild) ## About Freedesktop.org freedesktop.org is an open-source project focused on interoperability and shared technology for open-source graphical desktops. ## Latest Freedesktop.org vulnerabilities - [CVE-2026-120831: libslirp queue pointer corruption in if_output()](https://junglewise.ai/threats/cve-2026-120831-a-flaw-was-found-in-libslirp-in-if-output-when-moving-a-session) (medium, CVSS 6.5, published 3 Nov 2026) - [CVE-2026-105959: SPICE server heap buffer overflow in GLZ encoder](https://junglewise.ai/threats/cve-2026-105959-a-flaw-was-found-in-spice-server-the-glz-encoder-dictionary) (high, CVSS 7.5, published 16 Oct 2026) - [CVE-2026-93545: libXi out-of-bounds read in XListInputDevices()](https://junglewise.ai/threats/cve-2026-93545-an-out-of-bounds-read-in-libxi-s-xlistinputdevices-in-libxi) (medium, CVSS 6.5, published 24 Sep 2026) - [CVE-2026-96807: Flatpak symlink attack on .ld.so with arbitrary file writes](https://junglewise.ai/threats/cve-2026-96807-in-flatpak-before-1-18-1-a-malicious-sandboxed-app-can-replace) (medium, CVSS 4, published 23 Sep 2026) - [CVE-2026-16743: freedesktop.org accountsservice arbitrary file read in SetIconFile](https://junglewise.ai/threats/cve-2026-16743-freedesktop-org-accountsservice-arbitrary-file-read-in) (medium, CVSS 5.5, published 24 Jul 2026) - [CVE-2026-16118: xdgmime heap buffer overflow in _xdg_mime_magic_parse_magic_line](https://junglewise.ai/threats/cve-2026-16118-xdgmime-heap-buffer-overflow-in-xdg-mime-magic-parse-magic-line) (high, CVSS 7.1, published 17 Jul 2026) - [CVE-2026-9539: freedesktop.org libslirp heap OOB read in TCP urgent data handling](https://junglewise.ai/threats/cve-2026-9539-freedesktop-org-libslirp-heap-oob-read-in-tcp-urgent-data-handling) (medium, CVSS 6.5, published 24 Jun 2026) - [CVE-2026-50265: libinput privilege escalation via udev property injection in libinput-device-group](https://junglewise.ai/threats/cve-2026-50265-libinput-privilege-escalation-via-udev-property-injection-in) (high, CVSS 7, published 5 Jun 2026) - [CVE-2026-50292: freedesktop.org libinput CRLF injection in libinput-device-group](https://junglewise.ai/threats/cve-2026-50292-freedesktop-org-libinput-crlf-injection-in-libinput-device-group) (high, CVSS 7.4, published 4 Jun 2026) - [CVE-2026-10118: Poppler Splash backend integer overflow in tilingPatternFill](https://junglewise.ai/threats/cve-2026-10118-poppler-splash-backend-integer-overflow-in-tilingpatternfill) (high, CVSS 7.8, published 1 Jun 2026) - [CVE-2026-35093: freedesktop libinput code injection via Lua bytecode plugins](https://junglewise.ai/threats/cve-2026-35093-freedesktop-libinput-code-injection-via-lua-bytecode-plugins) (high, CVSS 8.8, published 1 Apr 2026) - [CVE-2025-50420: freedesktop Poppler infinite recursion in pdfseparate](https://junglewise.ai/threats/cve-2025-50420-freedesktop-poppler-infinite-recursion-in-pdfseparate) (medium, CVSS 6.5, published 4 Aug 2025) ## Most severe Freedesktop.org vulnerabilities - [CVE-2026-35093: freedesktop libinput code injection via Lua bytecode plugins](https://junglewise.ai/threats/cve-2026-35093-freedesktop-libinput-code-injection-via-lua-bytecode-plugins) (high, CVSS 8.8, published 1 Apr 2026) - [CVE-2026-10118: Poppler Splash backend integer overflow in tilingPatternFill](https://junglewise.ai/threats/cve-2026-10118-poppler-splash-backend-integer-overflow-in-tilingpatternfill) (high, CVSS 7.8, published 1 Jun 2026) - [CVE-2026-105959: SPICE server heap buffer overflow in GLZ encoder](https://junglewise.ai/threats/cve-2026-105959-a-flaw-was-found-in-spice-server-the-glz-encoder-dictionary) (high, CVSS 7.5, published 16 Oct 2026) - [CVE-2026-50292: freedesktop.org libinput CRLF injection in libinput-device-group](https://junglewise.ai/threats/cve-2026-50292-freedesktop-org-libinput-crlf-injection-in-libinput-device-group) (high, CVSS 7.4, published 4 Jun 2026) - [CVE-2026-16118: xdgmime heap buffer overflow in _xdg_mime_magic_parse_magic_line](https://junglewise.ai/threats/cve-2026-16118-xdgmime-heap-buffer-overflow-in-xdg-mime-magic-parse-magic-line) (high, CVSS 7.1, published 17 Jul 2026) - [CVE-2026-50265: libinput privilege escalation via udev property injection in libinput-device-group](https://junglewise.ai/threats/cve-2026-50265-libinput-privilege-escalation-via-udev-property-injection-in) (high, CVSS 7, published 5 Jun 2026) - [CVE-2025-50420: freedesktop Poppler infinite recursion in pdfseparate](https://junglewise.ai/threats/cve-2025-50420-freedesktop-poppler-infinite-recursion-in-pdfseparate) (medium, CVSS 6.5, published 4 Aug 2025) - [CVE-2026-93545: libXi out-of-bounds read in XListInputDevices()](https://junglewise.ai/threats/cve-2026-93545-an-out-of-bounds-read-in-libxi-s-xlistinputdevices-in-libxi) (medium, CVSS 6.5, published 24 Sep 2026) - [CVE-2026-120831: libslirp queue pointer corruption in if_output()](https://junglewise.ai/threats/cve-2026-120831-a-flaw-was-found-in-libslirp-in-if-output-when-moving-a-session) (medium, CVSS 6.5, published 3 Nov 2026) - [CVE-2026-9539: freedesktop.org libslirp heap OOB read in TCP urgent data handling](https://junglewise.ai/threats/cve-2026-9539-freedesktop-org-libslirp-heap-oob-read-in-tcp-urgent-data-handling) (medium, CVSS 6.5, published 24 Jun 2026) ## Vulnerabilities per week 2 vulnerabilities in the last four weeks, level on the four before (2). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 2 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 1 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 1 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Freedesktop.org technologies - [Freedesktop.org Poppler](https://junglewise.ai/threats/technologies/poppler): 4 vulnerabilities - [Freedesktop.org Libinput](https://junglewise.ai/threats/technologies/libinput): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Freedesktop.org vulnerabilities", https://junglewise.ai/threats/vendors/freedesktop-org, 10 November 2026.