Description
A buffer overflow when handling pointer barriers in the XFIXES extension in X.Org X server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.
Published: 2026-10-28
Score: 7.8 High
EPSS: n/a
KEV: No
Impact: Arbitrary code execution
Action: Patch ASAP
AI Analysis

Impact

The vulnerability is a buffer overflow in the XFIXES extension’s handling of pointer barrier events, categorised as CWE-122 and leading to an out‑of‑bounds write identified as CWE-787. When an authenticated X client creates more pointer barriers than the server’s internal buffer can accommodate, the server writes beyond the allocated boundaries, potentially crashing or allowing execution of code within the X server context.

Affected Systems

The vulnerability affects the X.Org X11 server before version 21.1.25 and XWayland before 24.1.14. All installed instances that accept pointer barrier configurations, whether X11 or XWayland, can be vulnerable.

Risk and Exploitability

The CVSS score of 7.8 indicates a high severity level. The EPSS is not available, and the CISA KEV catalog, indicating that publicly known exploits have not yet been observed. Because the flaw requires an authenticated client to manipulate pointer barriers, the attack surface is limited to trusted clients or local users with access to the server.

Generated by OpenCVE AI on October 28, 2026 at 17:37 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update to the latest X.Org X11 server release that contains the fixed buffer boundary checks.
  • Restrict or disable pointer barrier configuration for untrusted clients to prevent privilege escalation.
  • Apply access controls to limit which users can issue XFixes pointer barrier commands, ensuring only authorized processes can modify pointer barriers.

Generated by OpenCVE AI on October 28, 2026 at 17:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 15:00:00 +0000

Type Values Removed Values Added
Description A flaw was found in xorg-x11-server. The server writes pointer barrier events into a fixed-size buffer without properly validating boundaries. An authenticated client can trigger this issue by configuring excessive pointer barriers and generating cursor motion events, causing a buffer overflow. This vulnerability may lead to arbitrary code execution or cause the server to crash, resulting in a Denial of Service (DoS). A buffer overflow when handling pointer barriers in the XFIXES extension in X.Org X server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.
Title xorg-x11-server: XFixes Pointer Barrier Event List Buffer Overflow X.Org Server XFixes Pointer Barrier Event List Buffer Overflow
First Time appeared X.org
X.org xorg-x11-server
X.orgg
X.orgg xwayland
Weaknesses CWE-122
CPEs cpe:2.3:a:x.org:xorg-x11-server:*:*:*:*:*:*:*:*
cpe:2.3:a:x.orgg:xwayland:*:*:*:*:*:*:*:*
Vendors & Products X.org
X.org xorg-x11-server
X.orgg
X.orgg xwayland
References

Thu, 08 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
Description A flaw was found in xorg-x11-server. The server writes pointer barrier events into a fixed-size buffer without properly validating boundaries. An authenticated client can trigger this issue by configuring excessive pointer barriers and generating cursor motion events, causing a buffer overflow. This vulnerability may lead to arbitrary code execution or cause the server to crash, resulting in a Denial of Service (DoS).
Title xorg-x11-server: XFixes Pointer Barrier Event List Buffer Overflow
Weaknesses CWE-787
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Moderate

Subscriptions

X.org Xorg-x11-server
X.orgg Xwayland
cve-icon MITRE

Status: PUBLISHED

Assigner: suse

Published:

Updated: 2026-10-28T14:41:33.873Z

Reserved: 2026-09-18T08:46:56.692Z

Link: CVE-2026-93519

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-28T15:17:10.547

Modified: 2026-10-28T15:21:55.940

Link: CVE-2026-93519

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-07T12:00:00Z

Links: CVE-2026-93519 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T17:45:02Z

Weaknesses