X.org has 16 CVEs on record between 2023 and 2026. Disclosures have slowed: 2 in the last 90 days after 9 in the 90 before. The busiest recent month was June 2026 with 9. The median CVSS is 7.8 (high). None have a confirmed exploitation report. The dominant weakness classes are CWE-416 (6) and CWE-121 (3). Most affected products: x_server (14), libX11 (1), libXrender (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.8
- Publish → KEV
- —
- Last 90 days
- 2 prev 9
Products
- x_server 14
- libX11 1
- libXrender 1
Worst active — by depth score
CVE-2026-88807High· 8.9A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients.49CVE-2026-50264High· 7.8An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat43CVE-2026-50261High· 7.8A use-after-free flaw was found in the X.Org X server and Xwayland in SyncChangeCounter()43CVE-2026-50260High· 7.8A use-after-free flaw was found in the X.Org X server and Xwayland in FreeCounter()43CVE-2026-50259High· 7.8A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland43
X.org vulnerabilities
CVEs affecting X.org, newest first. Open any entry for full detail, references, and exploit status.
16 CVEsRSS
CVE-2026-88807High· 8.9A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients.
A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients.
CVE-2026-88806High· 7.5A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map.
A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map.
CVE-2026-50264High· 7.8An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat
An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat. A client that requests multiple DRI2BufferBackLeft attachments and one DRI2BufferFrontLeft can trigger an out-of-bounds he…
CVE-2026-50263Medium· 5.5A use-after-free flaw was found in the X.Org X server and Xwayland in CreateSaverWindow()
A use-after-free flaw was found in the X.Org X server and Xwayland in CreateSaverWindow(). A client can trigger a use-after-free read after changing window attributes and forcing the screen saver, leading to information disclosure.
CVE-2026-50262Medium· 5.5An out-of-bounds read flaw was found in the X.Org X server and Xwayland in __glXDisp_ChangeDrawableAttributes()
An out-of-bounds read flaw was found in the X.Org X server and Xwayland in __glXDisp_ChangeDrawableAttributes(). A wrong size validation check can read a client-controlled number of bytes, exceeding the request buffer, leading to informa…
CVE-2026-50261High· 7.8A use-after-free flaw was found in the X.Org X server and Xwayland in SyncChangeCounter()
A use-after-free flaw was found in the X.Org X server and Xwayland in SyncChangeCounter(). A client that sets up multiple SyncCounters can trigger a use-after-free when destroying those counters via a second client connection while chang…
CVE-2026-50260High· 7.8A use-after-free flaw was found in the X.Org X server and Xwayland in FreeCounter()
A use-after-free flaw was found in the X.Org X server and Xwayland in FreeCounter(). A client that sets up multiple SyncCounters and awaits on those triggers can trigger a use-after-free when destroying those counters via a second client…
CVE-2026-50259High· 7.8A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland
A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. _XkbSetMapChecks() declares a fixed-size stack buffer mapWidths[256] indexed by key type index. The helper function CheckKeyTypes() writes to this buffer at…
CVE-2026-50258High· 7.8A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland
A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. The X server has multiple stack buffers sized XkbMaxShiftLevel * XkbNumKbdGroups but CheckKeyTypes() does not verify or clamp non-canonical key types to Xkb…
CVE-2026-50257High· 7.8A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence()
A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence(). A client that sets up multiple fence triggers can trigger a use-after-free function pointer call. An attacker would connect to the X server to se…
CVE-2026-50256High· 7.8A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland
A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library's maximum font name length can cause a stack buffer overflow during font alias resolution. The ser…
CVE-2023-6478High· 7.6A flaw was found in xorg-server
A flaw was found in xorg-server. A specially crafted request to RRChangeProviderProperty or RRChangeOutputProperty can trigger an integer overflow which may lead to a disclosure of sensitive information.
CVE-2023-6377High· 7.8A flaw was found in xorg-server
A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to a mouse can result in out-of-bounds memory reads and writes. This may allow local privilege escalation or possible remote code exe…
CVE-2023-5574High· 7.0A use-after-free flaw was found in xorg-x11-server-Xvfb
A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped f…
CVE-2023-5380Medium· 4.7A use-after-free flaw was found in the xorg-x11-server
A use-after-free flaw was found in the xorg-x11-server. An X server crash may occur in a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode) if the pointer is warped fro…
CVE-2023-5367High· 7.8A out-of-bounds write flaw was found in the xorg-x11-server
A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect calculation of a buffer offset when copying data stored in the heap in the XIChangeDeviceProperty function in Xi/xiproperty.c and in RRCha…