{"id":"CVE-2026-109904","summary":"X.Org Server XRes QueryClientIds Request Size Overflow","details":"A buffer overread caused by an integer-overflow in Proc/SProcXResQueryClientIds in X.Org xwayland before 24.1.15 and X Server before 21.1.26 could be used by attackers on authenticated X clients to crash the server or leak out information.","modified":"2026-11-14T07:06:01.869791107Z","published":"2026-11-13T10:27:48.418Z","related":["SUSE-SU-2026:5178-1","SUSE-SU-2026:5180-1","openSUSE-SU-2026:12534-1","openSUSE-SU-2026:12535-1"],"database_specific":{"unresolved_ranges":[{"extracted_events":[{"range":[{"fixed":"21.1.26"},{"fixed":"24.1.15"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"}]},{"extracted_events":[{"source":"CPE_FIELD","strategy":"CPEApplicability","range":[{"fixed":"21.1.26"},{"fixed":"24.1.15"}]}]},{"extracted_events":[{"source":"DESCRIPTION","range":[{"fixed":"24.1.15"},{"fixed":"21.1.26"}]}]}],"cna_assigner":"suse","cwe_ids":["CWE-126"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109904.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109904.json"},{"type":"PACKAGE","url":"https://gitlab.freedesktop.org/xorg/xserver/"},{"type":"FIX","url":"https://gitlab.freedesktop.org/xorg/xserver/-/commit/a3899d75e180d73f2971af2a402e6fdf19c0339c"},{"type":"FIX","url":"https://gitlab.freedesktop.org/xorg/xserver/-/commit/ff754b812597177412f2e2fa2b1dd1eecbeb75cf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109904"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://gitlab.freedesktop.org/xorg/xserver","events":[{"introduced":"0"},{"fixed":"ff754b812597177412f2e2fa2b1dd1eecbeb75cf"},{"fixed":"a3899d75e180d73f2971af2a402e6fdf19c0339c"}],"database_specific":{"extracted_events":[{"range":[{"fixed":"ff754b812597177412f2e2fa2b1dd1eecbeb75cf"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"a3899d75e180d73f2971af2a402e6fdf19c0339c"}]}]}}],"versions":["xorg-server-21.1.25","server-26.1-branchpoint","xorg-server-21.1.24","xorg-server-21.1.23","xorg-server-21.1.22","xorg-server-21.1.21","xorg-server-21.1.20","xorg-server-21.1.19","xorg-server-21.1.18","xorg-server-21.1.17","xorg-server-21.1.16","xorg-server-21.1.15","xorg-server-21.1.14","xorg-server-21.1.13","xorg-server-21.1.12","xorg-server-21.1.11","xorg-server-21.1.10","xorg-server-21.1.9","xorg-server-21.1.8","xorg-server-21.1.7","xorg-server-21.1.6","xorg-server-21.1.5","xorg-server-21.1.4","xorg-server-21.1.3","xorg-server-21.1.2","xorg-server-21.1.1","xorg-server-21.1.0","xorg-server-21.0.99.902","xorg-server-21.0.99.901","xorg-server-21.0.99.1","xorg-server-1.20.0","xorg-server-1.19.99.905","xorg-server-1.19.99.904","xorg-server-1.19.99.903","xorg-server-1.19.99.902","xorg-server-1.19.99.901","xorg-server-1.19.0","xorg-server-1.18.99.902","xorg-server-1.18.99.901","xorg-server-1.18.99.2","xorg-server-1.18.0","xorg-server-1.17.99.902","xorg-server-1.17.99.901","xorg-server-1.17.0","xorg-server-1.16.99.902","xorg-server-1.16.99.901","xorg-server-1.16.0","xorg-server-1.15.99.904","xorg-server-1.15.99.903","xorg-server-1.15.99.902","xorg-server-1.15.99.901","xorg-server-1.15.0","xorg-server-1.14.99.905","xorg-server-1.14.99.904","xorg-server-1.14.99.903","xorg-server-1.14.99.902","xorg-server-1.14.99.901","xorg-server-1.14.99.3","xorg-server-1.14.99.2","xorg-server-1.14.99.1","xorg-server-1.14.0","xorg-server-1.13.99.902","xorg-server-1.13.99.901","xorg-server-1.13.0","xorg-server-1.12.99.905","xorg-server-1.12.99.904","xorg-server-1.12.99.903","xorg-server-1.12.99.902","xorg-server-1.12.99.901","xorg-server-1.12.0","xorg-server-1.11.99.903","xorg-server-1.11.99.902","xorg-server-1.11.99.901","xorg-server-1.11.99.1","xorg-server-1.11.0","xorg-server-1.10.99.902","xorg-server-1.10.99.901","xorg-server-1.10.0","xorg-server-1.9.99.903","xorg-server-1.9.99.902","xorg-server-1.9.99.901","xorg-server-1.9.0","xorg-server-1.8.99.906","xorg-server-1.8.99.905","xorg-server-1.8.99.904","xorg-server-1.8.99.903","xorg-server-1.8.99.902","xorg-server-1.8.99.901","xorg-server-1.8.0","xorg-server-1.7.99.902","xorg-server-1.7.99.901","xorg-server-1.7.99.2","xorg-server-1.7.99.1","xorg-server-1.6.99.901","xorg-server-1.6.99.900","xorg-server-1.5.99.1","xorg-server-1.1.99.3","xorg-server-1_1_99_2","xorg-server-1_0_99_901","XORG-7_0_99_901","xorg-server-1_1_99_1","xorg-server-1_0_99_2","xorg-server-1_0_99_1","XORG-7_0","pre-xgldrop-merge","XORG-6_99_99_904","MODULAR_COPY","XORG-6_99_99_903","XORG-6_8_99_903","DRM-2_0_0","XORG-6_99_99_902","XORG-6_8_99_902","DRM-1_0_5","XORG-6_99_99_901","XORG-6_8_99_901","DRM-20051017","kdrive-initial-import","xorg-server-0_99_1","XORG-6_99_99_900","XORG-6_8_99_900","XORG-6_8_99_16","XORG-6_8_99_15","XORG-6_8_99_14","XORG-6_8_99_13","XORG-6_8_99_12","DRM-20050615","sco_port_update-base","XORG-6_8_99_11","XORG-6_8_99_10","XORG-6_8_99_9","XORG-6_8_99_8","XORG-6_8_99_7","XORG-6_8_99_6","XORG-6_8_99_5","XORG-6_8_99_4","XORG-6_8_99_3","XORG-6_8_99_2","XORG-6_8_99_1","lg3d-base","XORG-6_8_0","XORG-6_7_99_904","XORG-6_7_99_903","XORG-6_7_99_902","XORG-6_7_99_901","XORG-6_7_99_2","XORG-6_7_99_1","DRM-20040721","DRI-trunk-20040721","DRI-trunk-20040613","DRI-XFree86-4_3_99_12-merge","DRM-20040613","XACE-SELINUX-MERGE","xf86-4_4_99_1","xf86-4_4_0","xf86-4_3_99_903","xf86-4_3_99_903_special","add-Xi","xf86-012804-2330","xf86-4_3_99_902","xf86-4_3_99_901","dri-0-1-branchpoint","xf86-4_3_99_16","xf86-4_3_0_1","PRE_xf86-4_3_0_1","XORG-MAIN","xfixes_2_branchpoint","keithp","xf-4_3_99_6","xf-4_3_99_5","xf-4_3_99_4","xf-4_3_99_3","xf-4_3_99_2","xf-4_3_99_1","xf-4_3_0_1","xf-4_3_0","xf-4_2_99_902","xf-4_2_99_901","xf-4_2_99_4","xf-4_2_99_3","ah-20021030-postdri","xf-4_2_99_2","ah-20021030","dhd-20020916","xf-4_2_99_1","dri-20020222-merge","before-mesa-4_0-import","dri-20020129-merge","xf-4_2_1_1","xf-4_2_1","xf-4_2_0_1","xf-4_2_0-bindist-1","xf-4_2_0-bindist","xf-4_2_0","xf-4_2-bp","xf-4_1_99_7","xf-4_1_99_6","xf-4_1_99_5","xf-4_1_99_4","Domain-sync4","Domain-sync3","xf-4_1_99_3","xf-4_1_99_2","Domain-sync2","Domain-sync1","Domain-base","xf-4_1_99_1","dhd-20010817","xf-4_0_99_900","xf-4_0_99_3","xf-4_0_99_2","dhd-20010328","xf-4_0_99_1","xf-4_0_2-bindist","xf-4_0_2","xf-4_0_1Zc","xf-4_0_1Zb","pre-R651-import","xf-4_0_1Za","xf-4_0_1Z","xf-4_0_1h","xf-4_0_1g","xf-4_0_1f","xf-4_0_1e","xf-4_0_1d","xf-4_0_1c","xf-4_0_1b","xf-4_0g","xf-4_0f","xf-4_0e","xf-4_0d","xf-4_0c","xf-4_0_1a","xf-4_0_1-bindist","xf-4_0_1","xf-4_0Z","xf-4_0b","xf-4_0a","xf-4_0-bindist","xf-4_0","xf-3_9_18b","xf-3_9_18a","xf-3_9_18Za","xf-3_9_18Z","xf-3_9_18","xf-3_9_17f","xf-3_9_17e","xf-3_9_17d","xf-3_9_17c","xf-3_9_17b","xf-3_9_17a","xf-3_9_17Z","xf-3_9_17","xf-3_9_16Za","xf-3_9_16f","xf-3_9_16e","xf-3_9_16d","xf-3_9_16Z"],"database_specific":{"vanir_signatures":[{"id":"CVE-2026-109904-000379d5","signature_type":"Line","signature_version":"v1","source":"https://gitlab.freedesktop.org/xorg/xserver@a3899d75e180d73f2971af2a402e6fdf19c0339c","target":{"file":"Xext/xres.c"},"deprecated":false,"digest":{"line_hashes":["189055601496879394726767597121965996680","61252641284731541362805314579838983035","298912088253386219961167848734453950729","318418183743156659003548233595417058454","121962287668769154286936773621838866211","323615648509245281611726738569225498489","190413116959071968596023068339235346816","193973848292550419542169124077023043679","207781653775631082179062900763057683112","306018522621693694289582915128506955266","292369582199491420861080298271621120776"],"threshold":0.9}},{"signature_version":"v1","source":"https://gitlab.freedesktop.org/xorg/xserver@a3899d75e180d73f2971af2a402e6fdf19c0339c","target":{"file":"Xext/xres.c","function":"ProcXResQueryClientIds"},"deprecated":false,"digest":{"length":837,"function_hash":"147971217166850971572012839056574378779"},"id":"CVE-2026-109904-4d4b0263","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://gitlab.freedesktop.org/xorg/xserver@a3899d75e180d73f2971af2a402e6fdf19c0339c","target":{"file":"Xext/xres.c","function":"SProcXResQueryClientIds"},"deprecated":false,"digest":{"function_hash":"30079849087068761670251954483438750774","length":180},"id":"CVE-2026-109904-5da08e4c"}],"vanir_signatures_modified":"2026-11-14T07:06:01Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109904.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"}]}