A month after fixing 12 X.Org bugs, the project shipped eight more fixes in xorg-server 21.1.26 and xwayland 24.1.15. Every earlier version is affected.
What’s broken
CVE-2026-109091 is the fun one: the Xorg server copies a monitor’s EDID display-range entries into fixed-size arrays without checking the count. A rigged monitor or crafted EDID can overflow them and crash the server or corrupt memory. The other seven are in X protocol request handling, four of them in the Xv video extension, where crafted sizes and offsets can read or write outside shared memory. One leaks memory contents.
If you’re on Wayland, you’re not off the hook. Xwayland runs your X11 apps, so it’s exposed too.
What to do
Update xorg-server and xwayland from your distro (on Omarchy/Arch, a normal sudo pacman -Syu), then log out and back in so the new binaries are running. Not sure which one you’re using? I put a how-to in this batch.
God Bless, and Happy hacking!
