---
id: CVE-2026-93517
title: X.Org Server GLX RenderLarge Heap Buffer Overflow
summary: "A heap buffer overflow in handling\_GLX\nRenderLarge request\_where dataBytes exceeds cmdlen in X.org X server before 21.1.25 and XWayland before 24.1.14\_that could be\_be triggered by an authenticated X client could cause crashes or code ex…"
severity: high
cvss: 8.5
cvssVector: 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-122
vendor: x.orgg
product: xorg-x11-server
affected:
  - xorg-x11-server < 21.1.25
  - xwayland < 24.1.14
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-05T18:29:53.620632Z'
published: '2026-10-28'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T18:30:21.407Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-93517'
references:
  - url: >-
      https://gitlab.freedesktop.org/xorg/xserver/-/commit/2abe4632d793314d3d5f28c19583fb76019f5ce4
tags:
  - cve.org
epss: 0.00193
epssPercentile: 0.08989
ingestedAt: '2026-10-28T14:12:18.563Z'
---

## Overview

A heap buffer overflow in handling GLX
RenderLarge request where dataBytes exceeds cmdlen in X.org X server before 21.1.25 and XWayland before 24.1.14 that could be be triggered by an authenticated X client could cause crashes or code execution in X server context.

## Affected

- `xorg-x11-server < 21.1.25`
- `xwayland < 24.1.14`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.