# cve.now: X.org

The newest entries naming X.org as an affected vendor (up to 200), of 47 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-93536](https://cve.now/CVE-2026-93536.md): X.Org Server GestureBuildSprite Use-After-Free (CVSS 5.3)
- [CVE-2026-93524](https://cve.now/CVE-2026-93524.md): X.Org Server XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read (CVSS 6.9)
- [CVE-2026-93523](https://cve.now/CVE-2026-93523.md): X.Org Server XInput2 PassiveUngrabDevice Out-of-Bounds Write (CVSS 7.8)
- [CVE-2026-93522](https://cve.now/CVE-2026-93522.md): X.Org Server Glamor CopyArea Heap Buffer Overflow (CVSS 7.8)
- [CVE-2026-93521](https://cve.now/CVE-2026-93521.md): X.Org Server RandR ChangeProviderProperty Heap Buffer Overflow (CVSS 7.8)
- [CVE-2026-93520](https://cve.now/CVE-2026-93520.md): X.Org Server XKB ChangeKeycodeRange Heap Out-of-Bounds Write (CVSS 7.8)
- [CVE-2026-93519](https://cve.now/CVE-2026-93519.md): X.Org Server XFixes Pointer Barrier Event List Buffer Overflow (CVSS 7.8)
- [CVE-2026-93518](https://cve.now/CVE-2026-93518.md): X.Org Server XKB ResizeKeyType Numeric Truncation (CVSS 7.8)
- [CVE-2026-93517](https://cve.now/CVE-2026-93517.md): X.Org Server GLX RenderLarge Heap Buffer Overflow (CVSS 8.5)
- [CVE-2026-93516](https://cve.now/CVE-2026-93516.md): .Org Server XInput Passive Grab Use-After-Free (CVSS 5.5)
- [CVE-2026-93515](https://cve.now/CVE-2026-93515.md): .Org Server Present Extension Use-After-Free (CVSS 6.8)
- [CVE-2026-88812](https://cve.now/CVE-2026-88812.md): X.Org Server XKB SetGeometry TextDoodad Double Free (CVSS 7.8)
- [CVE-2026-109090](https://cve.now/CVE-2026-109090.md): libXi XGetDeviceControl DEVICE\_ENABLE Heap Buffer Overflow (CVSS 7.5)
- [CVE-2026-109088](https://cve.now/CVE-2026-109088.md): libXtst RECORD EnableContext Reply Endless Loop (CVSS 6.5)
- [CVE-2026-109089](https://cve.now/CVE-2026-109089.md): libXi XGetDeviceControl Control Type Mismatch Heap Buffer Overflow (CVSS 7.5)
- [CVE-2026-94287](https://cve.now/CVE-2026-94287.md): Denial of service via unsigned underflow in libXpm's write path (CVSS 5.5)
- [CVE-2026-94286](https://cve.now/CVE-2026-94286.md): Out-of-bounds read in libXtst's RECORD reply parser (CVSS 7.1)
- [CVE-2026-94285](https://cve.now/CVE-2026-94285.md): Out-of-bounds read in libX11's byte-oriented codeset parser (CVSS 5.1)
- [CVE-2026-94284](https://cve.now/CVE-2026-94284.md): Out-of-bounds read vulnerability in libX11's XIM trigger-keyregistration parser.registration parser (CVSS 5.5)
- [CVE-2026-94283](https://cve.now/CVE-2026-94283.md): Out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser (CVSS 6.5)
- [CVE-2026-94282](https://cve.now/CVE-2026-94282.md): Out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion (CVSS 5.6)
- [CVE-2026-94281](https://cve.now/CVE-2026-94281.md): Out-of-bounds read in libXi's XListInputDevices() class parsing (CVSS 6.5)
- [CVE-2026-93545](https://cve.now/CVE-2026-93545.md): Out-of-bounds read in libXi's XListInputDevices() (CVSS 6.5)
- [CVE-2026-93544](https://cve.now/CVE-2026-93544.md): Out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing (CVSS 6.5)
- [CVE-2026-93543](https://cve.now/CVE-2026-93543.md): Out-of-bounds read in libXi's XI2 class parser (CVSS 7.4)
- [CVE-2026-93542](https://cve.now/CVE-2026-93542.md): Out-of-bounds read in libXi's XI2 class parsing via size\_classes() and copy\_classes() (CVSS 6.5)
- [CVE-2026-93541](https://cve.now/CVE-2026-93541.md): Out-of-bounds read in libXi's XQueryDeviceState() (CVSS 6.5)
- [CVE-2026-88807](https://cve.now/CVE-2026-88807.md): libXrender RenderQueryPictFormats Reply Heap-based Buffer Overflow (CVSS 8.9)
- [CVE-2026-88806](https://cve.now/CVE-2026-88806.md): libX11 XkbGetMap Reply Heap-based Buffer Overflow (CVSS 7.5)
- [CVE-2026-56003](https://cve.now/CVE-2026-56003.md): libXfont2 computeProps Property Buffer Heap Buffer Overflow (CVSS 8.5)
- [CVE-2026-56002](https://cve.now/CVE-2026-56002.md): libXfont2 PCF Font Parsing Heap Buffer Overflow (CVSS 8.5)
- [CVE-2026-56001](https://cve.now/CVE-2026-56001.md): libXfont2 BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow (CVSS 8.5)
- [CVE-2026-55999](https://cve.now/CVE-2026-55999.md): xorg-server / xwayland glamor font atlas Heap Buffer Overflow (CVSS 8.5)
- [CVE-2026-56000](https://cve.now/CVE-2026-56000.md): xorg-x11-server / xwayland GLX contextTags Use-After-Free in CommonMakeCurrent() (CVSS 9.0)
- [CVE-2025-62229](https://cve.now/CVE-2025-62229.md): Xorg: xmayland: use-after-free in xpresentnotify structure creation (CVSS 7.3)
- [CVE-2025-62230](https://cve.now/CVE-2025-62230.md): Xorg: xwayland: use-after-free in xkb client resource removal (CVSS 7.3)
- [CVE-2025-62231](https://cve.now/CVE-2025-62231.md): Xorg: xmayland: value overflow in xkbsetcompatmap() (CVSS 7.3)
- [CVE-2025-49180](https://cve.now/CVE-2025-49180.md): Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: integer overflow in x resize, rotate and reflect (randr) extension (CVSS 7.8)
- [CVE-2025-49179](https://cve.now/CVE-2025-49179.md): Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: integer overflow in x record extension (CVSS 7.3)
- [CVE-2025-49178](https://cve.now/CVE-2025-49178.md): Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: unprocessed client request due to bytes to ignore (CVSS 5.5)
- [CVE-2025-49177](https://cve.now/CVE-2025-49177.md): Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: data leak in xfixes extension's xfixessetclientdisconnectmode (CVSS 6.1)
- [CVE-2025-49176](https://cve.now/CVE-2025-49176.md): Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: integer overflow in big requests extension (CVSS 7.3)
- [CVE-2025-49175](https://cve.now/CVE-2025-49175.md): Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: out-of-bounds read in x rendering extension animated cursors (CVSS 6.1)
- [CVE-2022-49737](https://cve.now/CVE-2022-49737.md): In X.Org X server 20.11 through 21.1.16, when a client application uses easystroke for mouse gestures, the main thread modifies various data (CVSS 7.7)
- [CVE-2022-3553](https://cve.now/CVE-2022-3553.md): X.org Server xquartz X11Controller.m denial of service (CVSS 3.5)
- [CVE-2022-3551](https://cve.now/CVE-2022-3551.md): X.org Server xkb.c ProcXkbGetKbdByName memory leak (CVSS 3.5)
- [CVE-2022-3550](https://cve.now/CVE-2022-3550.md): X.org Server xkb.c \_GetCountedString buffer overflow (CVSS 5.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/x-org
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.