A use after free caused by missing lifecycle management of gesture sprites in GestureBuildSprite() in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash the X server or potentially execute code.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3261 advisory.

    CheckSetDoodad() in xkb/xkb.c frees doodad->text.text on error but doesnot NULL the pointer. When the     error path continues, _XkbClearDoodad() iscalled during cleanup and frees the same pointer again,     resulting in adouble free.An authenticated X client can trigger this by sending a crafted XkbSetGeometry     request with a malformed TextDoodad entry that causes the initial error path to be taken.

    The double free can lead to heap corruption, potentially enabling arbitrary code execution or denial of     service (crash).

    NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.htmlNOTE: Fixed by:
    https://gitlab.freedesktop.org/xorg/xserver/-/commit/c724006ee76fb002add50fcb4d97e8c96c279f09 (xorg-     server-21.1.25) (CVE-2026-88812)

    Present_clear_window_notifies() does not unlink notify entries from the per-window list before freeing     window_priv. When the window is subsequently destroyed or reused, the stale list entries are traversed,     resulting in a use-after-free.

    An authenticated X client can trigger this by creating cross-window Present notifies and then destroying     the target window. Both the Present and SYNC extensions must be enabled (they are by default).The use-     after-free can lead to denial of service (crash) or potentially information disclosure.

    NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.htmlNOTE: Fixed by:
    https://gitlab.freedesktop.org/xorg/xserver/-/commit/a469f98bcfab50dab607ff5ac24037632b0079a3 (xorg-     server-21.1.25) (CVE-2026-93515)

    XInput Passive Grab modifierDevice Use-After-Free

    NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.htmlNOTE: Fixed by:
    https://gitlab.freedesktop.org/xorg/xserver/-/commit/9442a53c137bb9eb61336c6fd39627912d50cc8d (xorg-     server-21.1.25) (CVE-2026-93516)

    In the GLX RenderLarge request handling, the buffer is allocated to the size of cmdlen but the subsequent     memcpy copies dataBytes into it. There is no validation that dataBytes is less than or equal to cmdlen,     allowing an attacker to write past the end of the allocated buffer.

    An authenticated X client can trigger this by sending a crafted GLX RenderLarge request where dataBytes     exceeds cmdlen, causing a  heap buffer overflow.The heap buffer overflow can lead to arbitrary code     execution or denial of service.

    NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.htmlNOTE: Fixed by:
    https://gitlab.freedesktop.org/xorg/xserver/-/commit/3961cdca467975a7d377f1f7bcd55d52eb3f417a (xorg-     server-21.1.25) (CVE-2026-93517)

    In XkbResizeKeyType(), the size_syms variable is declared as unsigned short. The expression (nTotal * 15)     / 10 can exceed 65535 for large nTotal values, and the result is truncated when assigned to the unsigned     short variable. This causes an undersized allocation, and subsequent writes overflow the heap buffer.

    An authenticated X client can trigger this by sending XKB requests that cause a key type resize with a     sufficiently large nTotal value.The heap buffer overflow resulting from the truncated allocation can lead     to arbitrary code execution or denial of service.

    NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.htmlNOTE: Fixed by:
    https://gitlab.freedesktop.org/xorg/xserver/-/commit/558ba8f784b0f5d4d96948051b2f04c983af20cc (xorg-     server-21.1.25) (CVE-2026-93518)

    Input_constrain_cursor() writes barrier events into a fixed-size buffer without checking bounds. When more     than 100 pointer barriers are active, the writes overflow the fixed buffer on the stack or heap. An     authenticated X client can trigger this by creating more than 100 pointer barriers (using the XFIXES     extension) and then generating pointer motion events (e.g. via XTEST). Both extensions are enabled by     default.

    The buffer overflow can lead to arbitrary code execution or denial of service.

    NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.htmlNOTE: Fixed by:
    https://gitlab.freedesktop.org/xorg/xserver/-/commit/9c3880d0745acefc98ed37e79498dfbe558a0f40 (xorg-     server-21.1.25) (CVE-2026-93519)

    In RRChangeProviderProperty() with PrependMode, new_value.size is set to len instead of total_len.
    Additionally, the old_data offset calculation uses prop_value->size instead of len for the memcpy of     existing data. This causes a heap buffer overflow when prepending property data, as the buffer is     undersized and the copy offset is incorrect.

    This mirrors a bug pattern that was previously fixed in RRChangeOutputProperty but was not applied to the     provider property path.

    An authenticated X client can trigger this by sending RandR ChangeProviderProperty requests with     PrependMode on a system with RandR providers (standard on modern GPUs).The heap buffer overflow can lead     to arbitrary code execution or denial of service.Fixed in: xorg-server-21.1.25 and xwayland-24.1.14Fix:
    https://gitlab.freedesktop.org/xorg/xserver/-/commit/5dc9efd5a199 (CVE-2026-93521)

    In glamor's CopyArea CPU-to-FBO path, the temporary buffer (tmp_bits) is sized based on the destination     height but is indexed using source coordinates. When the source region is taller than the destination,     writes overflow the allocated buffer.An authenticated X client can trigger this by performing a CopyArea     operation between drawables with mismatched depth (depth-24 to depth-32 or vice versa) where the source is     taller than the destination, on a system using glamor/GPU acceleration.

    The heap buffer overflow can lead to arbitrary code execution or denial of service.This issue does not     affect xorg-server-21.1.xFixed in: xwayland-24.1.14Fix:
    https://gitlab.freedesktop.org/xorg/xserver/-/commit/ad26c26bf795 (CVE-2026-93522)

    The XI2 passive ungrab path (XIPassiveUngrabDevice) is missing the modifier validation that exists in the     grab path and in legacy XI paths. Without checking against AllModifiersMask, a client can supply out-of-     range modifier values that lead to an out-of-bounds write when the modifier is used as an index.

    An authenticated X client can trigger this by sending an XIPassiveUngrabDevice request with an out-of-     range modifier value.The out-of-bounds write can lead to arbitrary code execution or denial of service.

    NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.htmlNOTE: Fixed by:
    https://gitlab.freedesktop.org/xorg/xserver/-/commit/aa56160fa213d8767e7da0c076b5c8242703313b (xorg-     server-21.1.25) (CVE-2026-93523)

    CheckKeySyms() in xkb/xkb.c populates a symsPerKey[] validation array with new key widths for keys in the     SetMap request range, then continues filling entries for keys beyond the range. However, the second loop     starts at index i = nKeySyms (the first loop's counter) rather than i = firstKeySym + nKeySyms. When     firstKeySym is large and nKeySyms is small, the second loop overwrites symsPerKey[target] with the old     width from the existing map.

    CheckKeyActions() then validates the wire action count against the stale old width and accepts it. In
    _XkbSetMap(), SetKeySyms() widens the key (resizing actions to nGroups * newWidth), but SetKeyActions()     then resizes again to the old count. A subsequent XkbGetMap request reads XkbKeyNumActions() entries     (derived from the new wider key_sym_map.width) from the shorter action allocation, causing an out-of-     bounds heap read. The overread bytes are copied into the GetMap reply and sent back to the requesting     client, producing a bounded heap information disclosure.

    NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.htmlNOTE: Fixed by:
    https://gitlab.freedesktop.org/xorg/xserver/-/commit/927ee1282d21550807619521bee909ef62ed0571 (xorg-     server-21.1.25) (CVE-2026-93524)

    GestureBuildSprite() copies raw WindowPtr values into the gesture sprite trace via CopySprite() without     any reference counting or lifetime management. WindowGone() only repairs touch sprite traces when a window     is destroyed -- gesture sprite traces are never checked or cleaned. This leaves stale WindowPtr references     in gesture sprites.

    When DeliverOneGestureEvent() later dereferences the stale WindowPtr via     DeepestSpriteWin(&gi->sprite)->drawable.id, it produces a use-after-free. The freed 4 bytes (drawable.id)     can be read back, potentially leaking information about the contents of the freed memory region.

    NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.htmlNOTE: Fixed by:
    https://gitlab.freedesktop.org/xorg/xserver/-/commit/4c9c345d2a10baf956fdefa83bb88681f7c840cf (xorg-     server-21.1.25) (CVE-2026-93536)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3260 advisory.

    CheckSetDoodad() in xkb/xkb.c frees doodad->text.text on error but doesnot NULL the pointer. When the     error path continues, _XkbClearDoodad() iscalled during cleanup and frees the same pointer again,     resulting in adouble free.An authenticated X client can trigger this by sending a crafted XkbSetGeometry     request with a malformed TextDoodad entry that causes the initial error path to be taken.

    The double free can lead to heap corruption, potentially enabling arbitrary code execution or denial of     service (crash).

    NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.htmlNOTE: Fixed by:
    https://gitlab.freedesktop.org/xorg/xserver/-/commit/c724006ee76fb002add50fcb4d97e8c96c279f09 (xorg-     server-21.1.25) (CVE-2026-88812)

    Present_clear_window_notifies() does not unlink notify entries from the per-window list before freeing     window_priv. When the window is subsequently destroyed or reused, the stale list entries are traversed,     resulting in a use-after-free.

    An authenticated X client can trigger this by creating cross-window Present notifies and then destroying     the target window. Both the Present and SYNC extensions must be enabled (they are by default).The use-     after-free can lead to denial of service (crash) or potentially information disclosure.

    NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.htmlNOTE: Fixed by:
    https://gitlab.freedesktop.org/xorg/xserver/-/commit/a469f98bcfab50dab607ff5ac24037632b0079a3 (xorg-     server-21.1.25) (CVE-2026-93515)

    XInput Passive Grab modifierDevice Use-After-Free

    NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.htmlNOTE: Fixed by:
    https://gitlab.freedesktop.org/xorg/xserver/-/commit/9442a53c137bb9eb61336c6fd39627912d50cc8d (xorg-     server-21.1.25) (CVE-2026-93516)

    In the GLX RenderLarge request handling, the buffer is allocated to the size of cmdlen but the subsequent     memcpy copies dataBytes into it. There is no validation that dataBytes is less than or equal to cmdlen,     allowing an attacker to write past the end of the allocated buffer.

    An authenticated X client can trigger this by sending a crafted GLX RenderLarge request where dataBytes     exceeds cmdlen, causing a  heap buffer overflow.The heap buffer overflow can lead to arbitrary code     execution or denial of service.

    NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.htmlNOTE: Fixed by:
    https://gitlab.freedesktop.org/xorg/xserver/-/commit/3961cdca467975a7d377f1f7bcd55d52eb3f417a (xorg-     server-21.1.25) (CVE-2026-93517)

    In XkbResizeKeyType(), the size_syms variable is declared as unsigned short. The expression (nTotal * 15)     / 10 can exceed 65535 for large nTotal values, and the result is truncated when assigned to the unsigned     short variable. This causes an undersized allocation, and subsequent writes overflow the heap buffer.

    An authenticated X client can trigger this by sending XKB requests that cause a key type resize with a     sufficiently large nTotal value.The heap buffer overflow resulting from the truncated allocation can lead     to arbitrary code execution or denial of service.

    NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.htmlNOTE: Fixed by:
    https://gitlab.freedesktop.org/xorg/xserver/-/commit/558ba8f784b0f5d4d96948051b2f04c983af20cc (xorg-     server-21.1.25) (CVE-2026-93518)

    Input_constrain_cursor() writes barrier events into a fixed-size buffer without checking bounds. When more     than 100 pointer barriers are active, the writes overflow the fixed buffer on the stack or heap. An     authenticated X client can trigger this by creating more than 100 pointer barriers (using the XFIXES     extension) and then generating pointer motion events (e.g. via XTEST). Both extensions are enabled by     default.

    The buffer overflow can lead to arbitrary code execution or denial of service.

    NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.htmlNOTE: Fixed by:
    https://gitlab.freedesktop.org/xorg/xserver/-/commit/9c3880d0745acefc98ed37e79498dfbe558a0f40 (xorg-     server-21.1.25) (CVE-2026-93519)

    In RRChangeProviderProperty() with PrependMode, new_value.size is set to len instead of total_len.
    Additionally, the old_data offset calculation uses prop_value->size instead of len for the memcpy of     existing data. This causes a heap buffer overflow when prepending property data, as the buffer is     undersized and the copy offset is incorrect.

    This mirrors a bug pattern that was previously fixed in RRChangeOutputProperty but was not applied to the     provider property path.

    An authenticated X client can trigger this by sending RandR ChangeProviderProperty requests with     PrependMode on a system with RandR providers (standard on modern GPUs).The heap buffer overflow can lead     to arbitrary code execution or denial of service.Fixed in: xorg-server-21.1.25 and xwayland-24.1.14Fix:
    https://gitlab.freedesktop.org/xorg/xserver/-/commit/5dc9efd5a199 (CVE-2026-93521)

    The XI2 passive ungrab path (XIPassiveUngrabDevice) is missing the modifier validation that exists in the     grab path and in legacy XI paths. Without checking against AllModifiersMask, a client can supply out-of-     range modifier values that lead to an out-of-bounds write when the modifier is used as an index.

    An authenticated X client can trigger this by sending an XIPassiveUngrabDevice request with an out-of-     range modifier value.The out-of-bounds write can lead to arbitrary code execution or denial of service.

    NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.htmlNOTE: Fixed by:
    https://gitlab.freedesktop.org/xorg/xserver/-/commit/aa56160fa213d8767e7da0c076b5c8242703313b (xorg-     server-21.1.25) (CVE-2026-93523)

    CheckKeySyms() in xkb/xkb.c populates a symsPerKey[] validation array with new key widths for keys in the     SetMap request range, then continues filling entries for keys beyond the range. However, the second loop     starts at index i = nKeySyms (the first loop's counter) rather than i = firstKeySym + nKeySyms. When     firstKeySym is large and nKeySyms is small, the second loop overwrites symsPerKey[target] with the old     width from the existing map.

    CheckKeyActions() then validates the wire action count against the stale old width and accepts it. In
    _XkbSetMap(), SetKeySyms() widens the key (resizing actions to nGroups * newWidth), but SetKeyActions()     then resizes again to the old count. A subsequent XkbGetMap request reads XkbKeyNumActions() entries     (derived from the new wider key_sym_map.width) from the shorter action allocation, causing an out-of-     bounds heap read. The overread bytes are copied into the GetMap reply and sent back to the requesting     client, producing a bounded heap information disclosure.

    NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.htmlNOTE: Fixed by:
    https://gitlab.freedesktop.org/xorg/xserver/-/commit/927ee1282d21550807619521bee909ef62ed0571 (xorg-     server-21.1.25) (CVE-2026-93524)

    GestureBuildSprite() copies raw WindowPtr values into the gesture sprite trace via CopySprite() without     any reference counting or lifetime management. WindowGone() only repairs touch sprite traces when a window     is destroyed -- gesture sprite traces are never checked or cleaned. This leaves stale WindowPtr references     in gesture sprites.

    When DeliverOneGestureEvent() later dereferences the stale WindowPtr via     DeepestSpriteWin(&gi->sprite)->drawable.id, it produces a use-after-free. The freed 4 bytes (drawable.id)     can be read back, potentially leaking information about the contents of the freed memory region.

    NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.htmlNOTE: Fixed by:
    https://gitlab.freedesktop.org/xorg/xserver/-/commit/4c9c345d2a10baf956fdefa83bb88681f7c840cf (xorg-     server-21.1.25) (CVE-2026-93536)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - GestureBuildSprite Use-After-Free (CVE-2026-93536)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4835-1 advisory.

    - CVE-2026-88812: XKB SetGeometry TextDoodad Double Free (bsc#1281213).
    - CVE-2026-93515: X.Org Server Present Extension Use-After-Free (bsc#1281218).
    - CVE-2026-93516: X.Org Server XInput Passive Grab Use-After-Free (bsc#1281220).
    - CVE-2026-93517: GLX RenderLarge Heap Buffer Overflow (bsc#1281225).
    - CVE-2026-93518: XKB ResizeKeyType Numeric Truncation (bsc#1281227).
    - CVE-2026-93519: XFixes Pointer Barrier Event List Buffer Overflow (bsc#1281233).
    - CVE-2026-93520: XKB ChangeKeycodeRange Heap Out-of-Bounds Write (bsc#1281236).
    - CVE-2026-93521: RandR ChangeProviderProperty Heap Buffer Overflow (bsc#1281238).
    - CVE-2026-93522: Glamor CopyArea Heap Buffer Overflow (bsc#1281240).
    - CVE-2026-93523: XInput2 PassiveUngrabDevice Out-of-Bounds Write (bsc#1281241).
    - CVE-2026-93524: XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read (bsc#1281242).
    - CVE-2026-93536: GestureBuildSprite Use-After-Free (bsc#1281244).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-112c430ffc advisory.

    Update to xwayland 24.1.14     CVE fix for: CVE-2026-88812, CVE-2026-93515, CVE-2026-93516     CVE-2026-93517, CVE-2026-93518, CVE-2026-93519,     CVE-2026-93520, CVE-2026-93521, CVE-2026-93522,     CVE-2026-93523, CVE-2026-93524, CVE-2026-93536

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-1507ef9e8c advisory.

    xorg-server-21.1.25 fixups

    ----

    Update to xserver 21.1.24, Security fixes for CVE-2026-88812, CVE-2026-93515, CVE-2026-93516,     CVE-2026-93517, CVE-2026-93518, CVE-2026-93519, CVE-2026-93520, CVE-2026-93521, CVE-2026-93522,     CVE-2026-93523, CVE-2026-93524, CVE-2026-93536

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  CVE-2026-93536


The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4647-1 advisory.

    - CVE-2026-88812: XKB SetGeometry TextDoodad Double Free (bsc#1281213).
    - CVE-2026-93515: X.Org Server Present Extension Use-After-Free (bsc#1281218).
    - CVE-2026-93516: X.Org Server XInput Passive Grab Use-After-Free (bsc#1281220).
    - CVE-2026-93517: GLX RenderLarge Heap Buffer Overflow (bsc#1281225).
    - CVE-2026-93518: XKB ResizeKeyType Numeric Truncation (bsc#1281227).
    - CVE-2026-93519: XFixes Pointer Barrier Event List Buffer Overflow (bsc#1281233).
    - CVE-2026-93520: XKB ChangeKeycodeRange Heap Out-of-Bounds Write (bsc#1281236).
    - CVE-2026-93521: RandR ChangeProviderProperty Heap Buffer Overflow (bsc#1281238).
    - CVE-2026-93523: XInput2 PassiveUngrabDevice Out-of-Bounds Write (bsc#1281241).
    - CVE-2026-93524: XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read (bsc#1281242).
    - CVE-2026-93536: GestureBuildSprite Use-After-Free (bsc#1281244).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4645-1 advisory.

    - CVE-2026-88812: XKB SetGeometry TextDoodad Double Free (bsc#1281213).
    - CVE-2026-93515: X.Org Server Present Extension Use-After-Free (bsc#1281218).
    - CVE-2026-93516: X.Org Server XInput Passive Grab Use-After-Free (bsc#1281220).
    - CVE-2026-93517: GLX RenderLarge Heap Buffer Overflow (bsc#1281225).
    - CVE-2026-93518: XKB ResizeKeyType Numeric Truncation (bsc#1281227).
    - CVE-2026-93519: XFixes Pointer Barrier Event List Buffer Overflow (bsc#1281233).
    - CVE-2026-93520: XKB ChangeKeycodeRange Heap Out-of-Bounds Write (bsc#1281236).
    - CVE-2026-93521: RandR ChangeProviderProperty Heap Buffer Overflow (bsc#1281238).
    - CVE-2026-93523: XInput2 PassiveUngrabDevice Out-of-Bounds Write (bsc#1281241).
    - CVE-2026-93524: XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read (bsc#1281242).
    - CVE-2026-93536: GestureBuildSprite Use-After-Free (bsc#1281244).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4646-1 advisory.

    - CVE-2026-88812: XKB SetGeometry TextDoodad Double Free (bsc#1281213).
    - CVE-2026-93515: X.Org Server Present Extension Use-After-Free (bsc#1281218).
    - CVE-2026-93516: X.Org Server XInput Passive Grab Use-After-Free (bsc#1281220).
    - CVE-2026-93517: GLX RenderLarge Heap Buffer Overflow (bsc#1281225).
    - CVE-2026-93518: XKB ResizeKeyType Numeric Truncation (bsc#1281227).
    - CVE-2026-93519: XFixes Pointer Barrier Event List Buffer Overflow (bsc#1281233).
    - CVE-2026-93520: XKB ChangeKeycodeRange Heap Out-of-Bounds Write (bsc#1281236).
    - CVE-2026-93521: RandR ChangeProviderProperty Heap Buffer Overflow (bsc#1281238).
    - CVE-2026-93523: XInput2 PassiveUngrabDevice Out-of-Bounds Write (bsc#1281241).
    - CVE-2026-93524: XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read (bsc#1281242).
    - CVE-2026-93536: GestureBuildSprite Use-After-Free (bsc#1281244).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2448dda850 advisory.

    Update to xwayland 24.1.14     CVE fix for: CVE-2026-88812, CVE-2026-93515, CVE-2026-93516     CVE-2026-93517, CVE-2026-93518, CVE-2026-93519,     CVE-2026-93520, CVE-2026-93521, CVE-2026-93522,     CVE-2026-93523, CVE-2026-93524, CVE-2026-93536

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be
    used by attached clients to cause a crash or potentially code in the x server context. (CVE-2026-88812)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 06bf834f-c31f-11f1-9b94-901b0e13f1a0 advisory.

    X.Org reports:
    Multiple issues have been found in the X server and Xwayland implementations                 published by X.Org for which we are releasing security fixes for in                 xorg-server-21.1.25 and xwayland-24.1.14.
                CVE-2026-88812: XKB SetGeometry TextDoodad Double Free                 CVE-2026-93515: Present Extension Cross-Window Notify Use-After-Free                 CVE-2026-93516: XInput Passive Grab modifierDevice Use-After-Free                 CVE-2026-93517: GLX RenderLarge Heap Buffer Overflow                 CVE-2026-93518: XKB ResizeKeyType Numeric Truncation                 CVE-2026-93519: XFixes Pointer Barrier Event List Buffer Overflow                 CVE-2026-93520: XKB ChangeKeycodeRange Heap Out-of-Bounds Write                 CVE-2026-93521: RandR ChangeProviderProperty Heap Buffer Overflow                 CVE-2026-93522: Glamor CopyArea CPU-FBO Heap Buffer Overflow                 CVE-2026-93523: XInput2 PassiveUngrabDevice Modifier Out-of-Bounds Write                 CVE-2026-93524: XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read                 CVE-2026-93536: GestureBuildSprite Use-After-Free


Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
371914	Amazon Linux 2023 : xorg-x11-server-Xwayland, xorg-x11-server-Xwayland-devel (ALAS2023-2026-3261)	Nessus	Amazon Linux Local Security Checks	Local	high
371867	Amazon Linux 2023 : xorg-x11-server-common, xorg-x11-server-devel, xorg-x11-server-source (ALAS2023-2026-3260)	Nessus	Amazon Linux Local Security Checks	Local	high
371365	Linux Distros Unpatched Vulnerability : CVE-2026-93536	Nessus	Misc.	Local	high
371095	SUSE SLED15 / SLES15 Security Update : xwayland (SUSE-SU-2026:4835-1)	Nessus	SuSE Local Security Checks	Local	high
367725	Fedora 43 : xorg-x11-server-Xwayland (2026-112c430ffc)	Nessus	Fedora Local Security Checks	Local	high
367723	Fedora 44 : xorg-x11-server (2026-1507ef9e8c)	Nessus	Fedora Local Security Checks	Local	high
474855	Echo: xorg-server: security update to 2:21.1.16-1.3+deb13u4+e2	Tenable Cloud Security	Echo Local Security Checks	Local	medium
474855	Echo: xorg-server: security update to 2:21.1.16-1.3+deb13u4+e2	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
366059	SUSE SLES15: xorg-x11-server / xorg-x11-server-Xvfb / xorg-x11-server-extra / etc (SUSE-SU-2026:4647-1)	Nessus	SuSE Local Security Checks	Local	high
366041	SUSE SLES15: xorg-x11-server / xorg-x11-server-Xvfb / xorg-x11-server-extra / etc (SUSE-SU-2026:4645-1)	Nessus	SuSE Local Security Checks	Local	high
366035	SUSE SLED15: xorg-x11-server / xorg-x11-server-Xvfb / xorg-x11-server-extra / etc (SUSE-SU-2026:4646-1)	Nessus	SuSE Local Security Checks	Local	high
364336	Fedora 44 : xorg-x11-server-Xwayland (2026-2448dda850)	Nessus	Fedora Local Security Checks	Local	high
473835	Alpine: multiple xorg-server packages: security update to 21.1.25-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
473835	Alpine: multiple xorg-server packages: security update to 21.1.25-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical
364284	FreeBSD : xorg -- Multiple vulnerabilities (06bf834f-c31f-11f1-9b94-901b0e13f1a0)	Nessus	FreeBSD Local Security Checks	Local	high
473645	Alpine: multiple xwayland packages: security update to 24.1.14-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
473645	Alpine: multiple xwayland packages: security update to 24.1.14-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical

Detections

Analytics

CVE-2026-93536

medium

Tenable Plugins

high

high

high

high

high

high

medium

medium

high

high

high

high

critical

critical

high

critical

critical