A use after free caused by missing lifecycle management of gesture sprites in GestureBuildSprite() in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash the X server or potentially execute code.
Fix
Vendor advisories in the News 1
- ZDI-26-780: X.Org Server GestureBuildSprite Use-After-Free Information Disclosure Vulnerability Zero Day Initiative: published advisories · 2026-10-16
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 3
- StatusReceived → PublishedNVD modified 2026-10-28 16:33
- StatusPublished → ReceivedNVD modified 2026-10-28 17:18
- First seenCVSS 5.3 · x.orgNVD modified 2026-10-28 16:33
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.