- CVE-2026-88812: Use-after-free/double free in XKB _CheckSetDoodad: doodad text pointer left dangling after free when reading the font string fails - CVE-2026-93516: Use-after-free in DIX: passive grabs keep dangling pointers to a removed input device (grab->device / modifierDevice) - CVE-2026-93517: Out-of-bounds read in GLX RenderLarge: dataBytes of the first request not validated against the request length - CVE-2026-93518: Heap buffer overflow in XKB key resize: 16-bit size_syms/num_syms/size_acts/num_acts truncate computed sizes, undersizing allocations - CVE-2026-93519: Out-of-bounds write in XInput barrier handling: input_constrain_cursor writes barrier events without a bounds check - CVE-2026-93521: Heap memory corruption in RandR RRChangeProviderProperty PrependMode due to wrong size and offset when shifting old data - CVE-2026-93522: Heap buffer overflow in glamor_upload_boxes: tmp_bits sized from pixmap height, not the source coordinate range - CVE-2026-93523: Out-of-bounds access in XInput ProcXIPassiveUngrabDevice: client-supplied modifier values are not validated