{
  "cveId": "CVE-2026-93536",
  "url": "https://patchblox.com/security/cve/CVE-2026-93536",
  "summary": "CVE-2026-93536 is fixed in 20 products on 1 platform, first by DEBIAN-CVE-2026-93536, released October 12, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "X.Org Server GestureBuildSprite Use-After-Free",
  "description": "A use after free caused by missing lifecycle management of gesture sprites in\u00A0GestureBuildSprite() in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash the X server or potentially execute code.",
  "published": "2026-10-12T08:18:20Z",
  "severity": "medium",
  "cvss": 5.3,
  "cvssVector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H",
  "cwe": "Heap-based Buffer Overflow",
  "epss": 0.00166,
  "epssPercentile": 0.05949,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-93536",
  "fixes": [
    {
      "platform": "linux",
      "product": "xorg-server",
      "release": "Debian 14",
      "fixedVersion": "2:21.1.25-1",
      "fix": "DEBIAN-CVE-2026-93536",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-93536",
      "released": "2026-10-12T23:16:46Z"
    },
    {
      "platform": "linux",
      "product": "xorg-x11-server",
      "release": "sles 15.6",
      "fixedVersion": "21.1.11-150600.5.34.1",
      "fix": "SUSE-SU-2026:4647-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4647-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "xorg-x11-server",
      "release": "sles 15.7",
      "fixedVersion": "21.1.15-150700.5.25.1",
      "fix": "SUSE-SU-2026:4646-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4646-1",
      "released": "2026-11-07T00:44:01Z"
    },
    {
      "platform": "linux",
      "product": "xorg-x11-server-Xephyr",
      "release": "amzn 2023",
      "fixedVersion": "21.1.13-5.amzn2023.0.12",
      "fix": "ALAS2023-2026-3260",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3260",
      "released": "2026-11-07T01:07:25Z"
    },
    {
      "platform": "linux",
      "product": "xorg-x11-server-Xephyr-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "21.1.13-5.amzn2023.0.12",
      "fix": "ALAS2023-2026-3260",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3260",
      "released": "2026-11-07T01:07:25Z"
    },
    {
      "platform": "linux",
      "product": "xorg-x11-server-Xnest",
      "release": "amzn 2023",
      "fixedVersion": "21.1.13-5.amzn2023.0.12",
      "fix": "ALAS2023-2026-3260",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3260",
      "released": "2026-11-07T01:07:25Z"
    },
    {
      "platform": "linux",
      "product": "xorg-x11-server-Xnest-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "21.1.13-5.amzn2023.0.12",
      "fix": "ALAS2023-2026-3260",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3260",
      "released": "2026-11-07T01:07:25Z"
    },
    {
      "platform": "linux",
      "product": "xorg-x11-server-Xorg",
      "release": "amzn 2023",
      "fixedVersion": "21.1.13-5.amzn2023.0.12",
      "fix": "ALAS2023-2026-3260",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3260",
      "released": "2026-11-07T01:07:25Z"
    },
    {
      "platform": "linux",
      "product": "xorg-x11-server-Xorg-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "21.1.13-5.amzn2023.0.12",
      "fix": "ALAS2023-2026-3260",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3260",
      "released": "2026-11-07T01:07:25Z"
    },
    {
      "platform": "linux",
      "product": "xorg-x11-server-Xvfb",
      "release": "amzn 2023",
      "fixedVersion": "21.1.13-5.amzn2023.0.12",
      "fix": "ALAS2023-2026-3260",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3260",
      "released": "2026-11-07T01:07:25Z"
    },
    {
      "platform": "linux",
      "product": "xorg-x11-server-Xvfb-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "21.1.13-5.amzn2023.0.12",
      "fix": "ALAS2023-2026-3260",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3260",
      "released": "2026-11-07T01:07:25Z"
    },
    {
      "platform": "linux",
      "product": "xorg-x11-server-Xwayland",
      "release": "amzn 2023",
      "fixedVersion": "24.1.3-1.amzn2023.0.7",
      "fix": "ALAS2023-2026-3261",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3261",
      "released": "2026-11-07T01:07:25Z"
    },
    {
      "platform": "linux",
      "product": "xorg-x11-server-Xwayland-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "24.1.3-1.amzn2023.0.7",
      "fix": "ALAS2023-2026-3261",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3261",
      "released": "2026-11-07T01:07:25Z"
    },
    {
      "platform": "linux",
      "product": "xorg-x11-server-Xwayland-debugsource",
      "release": "amzn 2023",
      "fixedVersion": "24.1.3-1.amzn2023.0.7",
      "fix": "ALAS2023-2026-3261",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3261",
      "released": "2026-11-07T01:07:25Z"
    },
    {
      "platform": "linux",
      "product": "xorg-x11-server-Xwayland-devel",
      "release": "amzn 2023",
      "fixedVersion": "24.1.3-1.amzn2023.0.7",
      "fix": "ALAS2023-2026-3261",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3261",
      "released": "2026-11-07T01:07:25Z"
    },
    {
      "platform": "linux",
      "product": "xorg-x11-server-common",
      "release": "amzn 2023",
      "fixedVersion": "21.1.13-5.amzn2023.0.12",
      "fix": "ALAS2023-2026-3260",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3260",
      "released": "2026-11-07T01:07:25Z"
    },
    {
      "platform": "linux",
      "product": "xorg-x11-server-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "21.1.13-5.amzn2023.0.12",
      "fix": "ALAS2023-2026-3260",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3260",
      "released": "2026-11-07T01:07:25Z"
    },
    {
      "platform": "linux",
      "product": "xorg-x11-server-debugsource",
      "release": "amzn 2023",
      "fixedVersion": "21.1.13-5.amzn2023.0.12",
      "fix": "ALAS2023-2026-3260",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3260",
      "released": "2026-11-07T01:07:25Z"
    },
    {
      "platform": "linux",
      "product": "xorg-x11-server-devel",
      "release": "amzn 2023",
      "fixedVersion": "21.1.13-5.amzn2023.0.12",
      "fix": "ALAS2023-2026-3260",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3260",
      "released": "2026-11-07T01:07:25Z"
    },
    {
      "platform": "linux",
      "product": "xorg-x11-server-source",
      "release": "amzn 2023",
      "fixedVersion": "21.1.13-5.amzn2023.0.12",
      "fix": "ALAS2023-2026-3260",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3260",
      "released": "2026-11-07T01:07:25Z"
    },
    {
      "platform": "linux",
      "product": "xwayland",
      "release": "Debian 14",
      "fixedVersion": "2:24.1.14-1",
      "fix": "DEBIAN-CVE-2026-93536",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-93536",
      "released": "2026-10-12T23:16:46Z"
    },
    {
      "platform": "linux",
      "product": "xwayland",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "24.1.6-160000.7.1",
      "fix": "OPENSUSE-SU-2026:22085-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22085-1",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "xwayland",
      "release": "sles 15.7",
      "fixedVersion": "24.1.5-150700.3.25.1",
      "fix": "SUSE-SU-2026:4835-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4835-1",
      "released": "2026-11-07T00:44:01Z"
    },
    {
      "platform": "linux",
      "product": "xwayland",
      "release": "sles 16.0",
      "fixedVersion": "24.1.6-160000.7.1",
      "fix": "SUSE-SU-2026:24230-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-24230-1",
      "released": "2026-11-07T00:45:20Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}