X. Org releases security patches for X server and Xwayland

The X. Org Foundation has released security updates to address multiple vulnerabilities within the X server and Xwayland compatibility layer. The patches cover approximately twelve security flaws, including double frees, use-after-frees, heap overflows, numeric truncation, and out-of-bounds reads.

These vulnerabilities affect several core extensions used daily, such as XKB, GLX, RandR, XFixes, XInput2, Present, and the glamor acceleration layer. Most of these flaws can be triggered by an authenticated local X client, meaning a compromised application on a user's machine could potentially seize a session, leak memory, or cause a denial of service.

The security fixes were delivered through several package releases, including xorg-server 21.1.25, a release candidate for 26.1.0, and xwayland 24.1.14. The vulnerabilities were identified through research conducted with the TrendAI Zero Day Initiative, a bounty program supported by Trend Micro.