CVE-2026-109091 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
suse	CNA	7.8 HIGH	LOCAL	LOW	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).

Vendor	Product	Version	Source
x.org	xwayland	𝑥 < 24.1.15	CNA

Debian Releases

Debian Product

Codename

xorg-server

bookworm	vulnerable
bookworm (security)	vulnerable
forky	vulnerable
sid	vulnerable
trixie	vulnerable
trixie (security)	vulnerable

xwayland

bookworm	unimportant
forky	unimportant
sid	unimportant
trixie	unimportant

openSUSE / SLES Releases

openSUSE Product

Release

xorg-x11-server

suse enterprise sap 12 SP5	1.19.6-10.117.1 fixed
suse enterprise sap 15 SP4	1.20.3-150400.38.80.1 fixed
suse enterprise server 12 SP5	1.19.6-10.117.1 fixed
suse enterprise server 15 SP4	1.20.3-150400.38.80.1 fixed

xorg-x11-server-extra

suse enterprise sap 12 SP5	1.19.6-10.117.1 fixed
suse enterprise sap 15 SP4	1.20.3-150400.38.80.1 fixed
suse enterprise server 12 SP5	1.19.6-10.117.1 fixed
suse enterprise server 15 SP4	1.20.3-150400.38.80.1 fixed

xorg-x11-server-sdk

suse enterprise sap 15 SP4	1.20.3-150400.38.80.1 fixed
suse enterprise server 15 SP4	1.20.3-150400.38.80.1 fixed

Amazon Linux Releases

Amazon Package

Release

xorg-x11-server-Xdmx

Amazon Linux 2

0:1.20.4-22.amzn2.0.15

fixed

xorg-x11-server-Xephyr

Amazon Linux 2	0:1.20.4-22.amzn2.0.15 fixed
Amazon Linux 2023	0:21.1.13-5.amzn2023.0.13 fixed

xorg-x11-server-Xephyr-debuginfo

Amazon Linux 2023

0:21.1.13-5.amzn2023.0.13

fixed

xorg-x11-server-Xnest

Amazon Linux 2	0:1.20.4-22.amzn2.0.15 fixed
Amazon Linux 2023	0:21.1.13-5.amzn2023.0.13 fixed

xorg-x11-server-Xnest-debuginfo

Amazon Linux 2023

0:21.1.13-5.amzn2023.0.13

fixed

xorg-x11-server-Xorg

Amazon Linux 2	0:1.20.4-22.amzn2.0.15 fixed
Amazon Linux 2023	0:21.1.13-5.amzn2023.0.13 fixed

xorg-x11-server-Xorg-debuginfo

Amazon Linux 2023

0:21.1.13-5.amzn2023.0.13

fixed

xorg-x11-server-Xvfb

Amazon Linux 2	0:1.20.4-22.amzn2.0.15 fixed
Amazon Linux 2023	0:21.1.13-5.amzn2023.0.13 fixed

xorg-x11-server-Xvfb-debuginfo

Amazon Linux 2023

0:21.1.13-5.amzn2023.0.13

fixed

xorg-x11-server-Xwayland

Amazon Linux 2

0:1.20.4-22.amzn2.0.15

fixed

xorg-x11-server-common

Amazon Linux 2	0:1.20.4-22.amzn2.0.15 fixed
Amazon Linux 2023	0:21.1.13-5.amzn2023.0.13 fixed

xorg-x11-server-debuginfo

Amazon Linux 2	0:1.20.4-22.amzn2.0.15 fixed
Amazon Linux 2023	0:21.1.13-5.amzn2023.0.13 fixed

xorg-x11-server-debugsource

Amazon Linux 2023

0:21.1.13-5.amzn2023.0.13

fixed

xorg-x11-server-devel

Amazon Linux 2	0:1.20.4-22.amzn2.0.15 fixed
Amazon Linux 2023	0:21.1.13-5.amzn2023.0.13 fixed

xorg-x11-server-source

Amazon Linux 2	0:1.20.4-22.amzn2.0.15 fixed
Amazon Linux 2023	0:21.1.13-5.amzn2023.0.13 fixed

Common Weakness Enumeration

CWE-122 - Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Vulnerability Media Exposure

[GERMAN] Xwayland und X.Org X Server: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Xwayland und X.Org X11 ausnutzen, um einen Denial of Service Angriff durchzuführen, möglicherweise vertrauliche Informationen offenzulegen oder den Speicher zu beschädigen.
Published: 2026-11-10T23:00:00+00:00

References

https://gitlab.freedesktop.org/xorg/xserver/-/commit/56e4ab6e8d94222480c8d7a28f530334059e3ab7

https://gitlab.freedesktop.org/xorg/xserver/-/commit/d88f0f7fdb2834c24feca63c0af5f46a57f4a04c