# X.org vulnerabilities Source: https://junglewise.ai/threats/vendors/x-org Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 10 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/x-org.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 35 vulnerabilities in X.org: 0 in the last 7 days and 23 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-93536, was published on 28 October 2026. 13 vulnerabilities in the last four weeks, up 63% on the four before (8). 6 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 13 - Last 90 days: 23 - All time: 35 (3 critical, 0 exploited in the wild) ## About X.org X.Org is an open-source project that maintains the X Window System implementation. ## Latest X.org vulnerabilities - [CVE-2026-93536: X.Org X Server use after free in gesture sprite lifecycle](https://junglewise.ai/threats/cve-2026-93536-a-use-after-free-caused-by-missing-lifecycle-management-of) (medium, CVSS 5.3, published 28 Oct 2026) - [CVE-2026-93524: X.Org X Server buffer overread in CheckKeySyms](https://junglewise.ai/threats/cve-2026-93524-a-buffer-overread-in-checkkeysyms-in-x-org-x-server-before-21-1) (info, published 28 Oct 2026) - [CVE-2026-93523: X.Org X Server heap buffer overflow in XIPassiveUngrabDevice](https://junglewise.ai/threats/cve-2026-93523-a-heap-buffer-overflow-caused-by-a-xipassiveungrabdevice-request) (high, CVSS 7.8, published 28 Oct 2026) - [CVE-2026-93522: X.Org X Server heap buffer overflow in CopyArea CPU-to-FBO](https://junglewise.ai/threats/cve-2026-93522-a-heap-buffer-overflow-caused-by-mismatched-size-usage-in) (high, CVSS 7.8, published 28 Oct 2026) - [CVE-2026-93521: X.Org X Server buffer overflow in RandR ChangeProviderProperty](https://junglewise.ai/threats/cve-2026-93521-a-buffer-overflow-in-randr-changeproviderproperty-requests-in-x) (high, CVSS 7.8, published 28 Oct 2026) - [CVE-2026-93520: X.org X server heap buffer overflow in XkbAllocNames](https://junglewise.ai/threats/cve-2026-93520-a-heap-buffer-overflow-caused-by-mismatching-size-calculations) (high, CVSS 7.8, published 28 Oct 2026) - [CVE-2026-93519: X.Org X server buffer overflow in XFIXES pointer barriers](https://junglewise.ai/threats/cve-2026-93519-a-buffer-overflow-when-handling-pointer-barriers-in-the-xfixes) (high, CVSS 7.8, published 28 Oct 2026) - [CVE-2026-93518: X.org X server integer truncation in XkbResizeKeyType heap buffer overflow](https://junglewise.ai/threats/cve-2026-93518-an-integer-truncation-issue-in-xkbresizekeytype-that-could-lead) (high, CVSS 7.8, published 28 Oct 2026) - [CVE-2026-93517: X.org X server and XWayland heap buffer overflow in GLX RenderLarge](https://junglewise.ai/threats/cve-2026-93517-a-heap-buffer-overflow-in-handling-glx-renderlarge-request-where) (info, published 28 Oct 2026) - [CVE-2026-93516: X.org X Server use-after-free in XInput device lifecycle](https://junglewise.ai/threats/cve-2026-93516-a-use-after-free-caused-by-lack-of-lifecycle-management-when) (medium, CVSS 5.5, published 28 Oct 2026) - [CVE-2026-93515: X.org X Server use-after-free in present_clear_window_notifies](https://junglewise.ai/threats/cve-2026-93515-a-use-after-free-in-present-clear-window-notifies-in-the-x-org-x) (info, published 28 Oct 2026) - [CVE-2026-109090: libXi heap overflow in DEVICE_ENABLE reply handling](https://junglewise.ai/threats/cve-2026-109090-a-malicious-x-server-could-cause-a-heap-overflow-by-injecting-a) (high, CVSS 7.5, published 27 Oct 2026) - [CVE-2026-109089: libXi heap buffer overflow in DEVICE_RESOLUTION handling](https://junglewise.ai/threats/cve-2026-109089-a-buffer-overflow-when-handling-device-resolution-in-libxi) (high, CVSS 7.5, published 27 Oct 2026) - [CVE-2026-94284: libX11 out-of-bounds read in XIM trigger-key registration parser](https://junglewise.ai/threats/cve-2026-94284-an-out-of-bounds-read-vulnerability-in-libx11-s-xim-trigger-key) (medium, CVSS 5.5, published 28 Sep 2026) - [CVE-2026-94283: libX11 out-of-bounds read in XIM attribute parser](https://junglewise.ai/threats/cve-2026-94283-an-out-of-bounds-read-vulnerability-in-libx11-s-xim-x-input) (medium, CVSS 6.5, published 28 Sep 2026) - [CVE-2026-94281: libXi out-of-bounds read in XListInputDevices() class parsing](https://junglewise.ai/threats/cve-2026-94281-an-out-of-bounds-read-in-libxi-s-xlistinputdevices-class-parsing) (medium, CVSS 6.5, published 24 Sep 2026) - [CVE-2026-93544: libXi out-of-bounds read in XI2 XIQueryDevice reply parsing](https://junglewise.ai/threats/cve-2026-93544-an-out-of-bounds-read-in-libxi-s-xi2-xiquerydevice-reply-parsing) (medium, CVSS 6.5, published 24 Sep 2026) - [CVE-2026-93543: libXi out-of-bounds read in XI2 class parser](https://junglewise.ai/threats/cve-2026-93543-an-out-of-bounds-read-in-libxi-s-xi2-class-parser-in-libxi-before) (high, CVSS 7.4, published 24 Sep 2026) - [CVE-2026-93542: libXi out-of-bounds read in XI2 class parsing](https://junglewise.ai/threats/cve-2026-93542-an-out-of-bounds-read-in-libxi-s-xi2-class-parsing-via-size) (medium, CVSS 6.5, published 24 Sep 2026) - [CVE-2026-93541: libXi out-of-bounds read in XQueryDeviceState](https://junglewise.ai/threats/cve-2026-93541-an-out-of-bounds-read-in-libxi-s-xquerydevicestate-in-libxi) (medium, CVSS 6.5, published 24 Sep 2026) - [CVE-2026-88806: libX11 buffer overflow in XkbGetMap key_sym_map handling](https://junglewise.ai/threats/cve-2026-88806-a-malicious-x-server-could-exploit-a-buffer-overflow-in-libx11) (high, CVSS 7.5, published 21 Sep 2026) - [CVE-2026-59679: libXfont2 out-of-bounds heap access in fs_read_glyphs()](https://junglewise.ai/threats/cve-2026-59679-libxfont2-out-of-bounds-heap-access-in-fs-read-glyphs) (critical, CVSS 9, published 10 Sep 2026) - [CVE-2026-44950: X.Org libXfont2 heap buffer overflow in fs_read_glyphs](https://junglewise.ai/threats/cve-2026-44950-x-org-libxfont2-heap-buffer-overflow-in-fs-read-glyphs) (critical, CVSS 9, published 10 Sep 2026) - [CVE-2026-72693: X.Org openvt privilege escalation via TTY ownership race condition](https://junglewise.ai/threats/cve-2026-72693-x-org-openvt-privilege-escalation-via-tty-ownership-race) (high, CVSS 7.8, published 11 Aug 2026) - [CVE-2026-56003: X.Org libXfont2 heap buffer overflow in ComputeScaledProperties](https://junglewise.ai/threats/cve-2026-56003-x-org-libxfont2-heap-buffer-overflow-in-computescaledproperties) (high, CVSS 8.5, published 8 Jul 2026) ## Most severe X.org vulnerabilities - [CVE-1999-0526: X.Org X Server access control bypass via insecure xhost configuration](https://junglewise.ai/threats/cve-1999-0526-x-org-x-server-access-control-bypass-via-insecure-xhost) (critical, CVSS 10, published 1 Jul 1997) - [CVE-2026-44950: X.Org libXfont2 heap buffer overflow in fs_read_glyphs](https://junglewise.ai/threats/cve-2026-44950-x-org-libxfont2-heap-buffer-overflow-in-fs-read-glyphs) (critical, CVSS 9, published 10 Sep 2026) - [CVE-2026-59679: libXfont2 out-of-bounds heap access in fs_read_glyphs()](https://junglewise.ai/threats/cve-2026-59679-libxfont2-out-of-bounds-heap-access-in-fs-read-glyphs) (critical, CVSS 9, published 10 Sep 2026) - [CVE-2026-56003: X.Org libXfont2 heap buffer overflow in ComputeScaledProperties](https://junglewise.ai/threats/cve-2026-56003-x-org-libxfont2-heap-buffer-overflow-in-computescaledproperties) (high, CVSS 8.5, published 8 Jul 2026) - [CVE-2026-56002: X.Org libXfont2 heap buffer overflow in pcfReadFont](https://junglewise.ai/threats/cve-2026-56002-x-org-libxfont2-heap-buffer-overflow-in-pcfreadfont) (high, CVSS 8.5, published 8 Jul 2026) - [CVE-2026-56001: X.Org libXfont2 heap buffer overflow in BitmapScaleBitmaps](https://junglewise.ai/threats/cve-2026-56001-x-org-libxfont2-heap-buffer-overflow-in-bitmapscalebitmaps) (high, CVSS 8.5, published 8 Jul 2026) - [CVE-2026-55999: X.Org xorg-server and xwayland heap buffer overflow in glamor font atlas](https://junglewise.ai/threats/cve-2026-55999-x-org-xorg-server-and-xwayland-heap-buffer-overflow-in-glamor) (high, CVSS 8.5, published 8 Jul 2026) - [CVE-2026-72693: X.Org openvt privilege escalation via TTY ownership race condition](https://junglewise.ai/threats/cve-2026-72693-x-org-openvt-privilege-escalation-via-tty-ownership-race) (high, CVSS 7.8, published 11 Aug 2026) - [CVE-2026-93523: X.Org X Server heap buffer overflow in XIPassiveUngrabDevice](https://junglewise.ai/threats/cve-2026-93523-a-heap-buffer-overflow-caused-by-a-xipassiveungrabdevice-request) (high, CVSS 7.8, published 28 Oct 2026) - [CVE-2026-93522: X.Org X Server heap buffer overflow in CopyArea CPU-to-FBO](https://junglewise.ai/threats/cve-2026-93522-a-heap-buffer-overflow-caused-by-mismatched-size-usage-in) (high, CVSS 7.8, published 28 Oct 2026) ## Vulnerabilities per week 13 vulnerabilities in the last four weeks, up 63% on the four before (8). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 2 | 2 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 6 | 0 | 0 | | 28 Sep 2026 | 2 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 13 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## X.org technologies - [X.org X Server](https://junglewise.ai/threats/technologies/x-org-x-server): 11 vulnerabilities - [X.org XWayland](https://junglewise.ai/threats/technologies/x-org-xwayland): 10 vulnerabilities - [X.org libXi](https://junglewise.ai/threats/technologies/libxi): 7 vulnerabilities - [X.org libXfont2](https://junglewise.ai/threats/technologies/libxfont2): 5 vulnerabilities - [X.org Xorg-Server](https://junglewise.ai/threats/technologies/xorg-server): 5 vulnerabilities - [X.org libX11](https://junglewise.ai/threats/technologies/libx11): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "X.org vulnerabilities", https://junglewise.ai/threats/vendors/x-org, 10 November 2026.