{"id":"SUSE-SU-2026:4835-1","summary":"Security update for xwayland","details":"This update for xwayland fixes the following issues:\n\n- CVE-2026-88812: XKB SetGeometry TextDoodad Double Free (bsc#1281213).\n- CVE-2026-93515: X.Org Server Present Extension Use-After-Free (bsc#1281218).\n- CVE-2026-93516: X.Org Server XInput Passive Grab Use-After-Free (bsc#1281220).\n- CVE-2026-93517: GLX RenderLarge Heap Buffer Overflow (bsc#1281225).\n- CVE-2026-93518: XKB ResizeKeyType Numeric Truncation (bsc#1281227).\n- CVE-2026-93519: XFixes Pointer Barrier Event List Buffer Overflow (bsc#1281233).\n- CVE-2026-93520: XKB ChangeKeycodeRange Heap Out-of-Bounds Write (bsc#1281236).\n- CVE-2026-93521: RandR ChangeProviderProperty Heap Buffer Overflow (bsc#1281238).\n- CVE-2026-93522: Glamor CopyArea Heap Buffer Overflow (bsc#1281240).\n- CVE-2026-93523: XInput2 PassiveUngrabDevice Out-of-Bounds Write (bsc#1281241).\n- CVE-2026-93524: XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read (bsc#1281242).\n- CVE-2026-93536: GestureBuildSprite Use-After-Free (bsc#1281244).\n","modified":"2026-10-22T11:45:03.857231817Z","published":"2026-10-21T12:51:34Z","related":["CVE-2026-88812","CVE-2026-93515","CVE-2026-93516","CVE-2026-93517","CVE-2026-93518","CVE-2026-93519","CVE-2026-93520","CVE-2026-93521","CVE-2026-93522","CVE-2026-93523","CVE-2026-93524","CVE-2026-93536"],"upstream":["CVE-2026-88812","CVE-2026-93515","CVE-2026-93516","CVE-2026-93517","CVE-2026-93518","CVE-2026-93519","CVE-2026-93520","CVE-2026-93521","CVE-2026-93522","CVE-2026-93523","CVE-2026-93524","CVE-2026-93536"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264835-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1281213"},{"type":"REPORT","url":"https://bugzilla.suse.com/1281218"},{"type":"REPORT","url":"https://bugzilla.suse.com/1281220"},{"type":"REPORT","url":"https://bugzilla.suse.com/1281225"},{"type":"REPORT","url":"https://bugzilla.suse.com/1281227"},{"type":"REPORT","url":"https://bugzilla.suse.com/1281233"},{"type":"REPORT","url":"https://bugzilla.suse.com/1281236"},{"type":"REPORT","url":"https://bugzilla.suse.com/1281238"},{"type":"REPORT","url":"https://bugzilla.suse.com/1281240"},{"type":"REPORT","url":"https://bugzilla.suse.com/1281241"},{"type":"REPORT","url":"https://bugzilla.suse.com/1281242"},{"type":"REPORT","url":"https://bugzilla.suse.com/1281244"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-88812"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-93515"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-93516"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-93517"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-93518"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-93519"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-93520"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-93521"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-93522"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-93523"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-93524"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-93536"}],"affected":[{"package":{"name":"xwayland","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","purl":"pkg:rpm/suse/xwayland&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2015%20SP7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.1.5-150700.3.25.1"}]}],"ecosystem_specific":{"binaries":[{"xwayland":"24.1.5-150700.3.25.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4835-1.json"}}],"schema_version":"1.9.0"}