X.Org Server 26.1.0 RC4 fixes eight memory-safety flaws
The candidate closes out-of-bounds writes and size overflows in EDID parsing, XVideo, synthetic input, and resource queries.
X.Org has tagged xorg-server 26.0.99.904, the fourth release candidate for 26.1.0, with fixes for eight flaws that let malformed client data write past buffers or overflow size calculations inside the display server.
Olivier Fourdan announced the batch. The bugs are in code that handles monitor capability data, shared-memory video images, synthetic input, and resource accounting. An out-of-bounds write or an unchecked size on those paths can crash the server or corrupt its memory, which takes the graphical session down with it.
The fixes cover:
CVE-2026-109091, an out-of-bounds write while handling EDID DS_RANGES data.
CVE-2026-109092, a bounds overflow in shared-memory image puts (XvShmPutImage).
CVE-2026-109093, a stack out-of-bounds write when processing valuators for fake input (XTestFakeInput).
CVE-2026-109904, a request-size overflow in client-id queries (XRes QueryClientIds).
CVE-2026-109094, a size overflow on the byte-swapped path of resource-byte queries (XRes QueryResourceBytes).
CVE-2026-109095, an integer overflow in glamor when sizing an XVideo image.
CVE-2026-109096, a length check in XvPutImage that a negative image size can bypass.
CVE-2026-109903, a reply built from a negative size in XvQueryImageAttributes.