CVE-2026-88812

HighCVSS 7.8/10Last modified Nov 4, 2026

Description

A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a crash or potentially code in the x server context.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-415

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
X.org	xorg-x11-server	< 21.1.25
x.org	xwayland	< 24.1.14

References

https://gitlab.freedesktop.org/xorg/xserver/-/commit/0d1b1b0bad86c9ea2a3b7ca5a70e681dc69f1ecc

Timeline

Published: Oct 27, 2026
Last modified: Nov 4, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-888135.3The YITH WooCommerce Gift Cards WordPress plugin through 4.39.0 does not reconcile the value of a gift card it issues against the amount act CVE-2026-888143.7The YITH WooCommerce Gift Cards WordPress plugin before 4.38.1 does not lock or atomically update a gift card's balance when it is redeemed CVE-2026-888156.2DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv. When casting to SQL_NUMERIC, sql_type CVE-2026-888167.5DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName. fetchrow_hashref uses the string pointe CVE-2026-888178.7An authenticated, non-guest user of Curiosity Workspace could enroll themselves as an administrator and member of an existing access group w CVE-2026-888196.3In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID.CVE-2026-88826.4The WP ApplicantStack Jobs Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all version CVE-2026-88822Issue summary: QUIC, when performing automated peer detection, may allow uninitialized stack data to leak into the received address which is CVE-2026-88823Issue summary: The AES-GCM-SIV implementation treats a zero-length Additional Authenticated Data (AAD) update as a reset of all the AAD supp CVE-2026-888248.8The Master Blocks WordPress plugin before 1.5.0 does not have authorisation on one of its REST routes, allowing unauthenticated users to up CVE-2026-888258.8The iGMS Direct Booking WordPress plugin before 2.0 does not authorise or escape its widget appearance settings, allowing unauthenticated us CVE-2026-888268.8The SmugMug Embed WordPress plugin through 3.13 does not have authorisation or CSRF checks on an AJAX action that stores gallery data, and d