Free tools Windows power users keep installed
One-click scans. No signup required.
Check the version of the X.Org server or Xwayland that your system is running, then confirm the package’s fix status with your Linux distribution. The latest entry on the X.Org security index, dated July 8, 2026, lists xorg-server 21.1.24 and Xwayland 24.1.13 as fixed versions. Those are upstream release thresholds—not a universal test for whether a distribution package is vulnerable, because distributors may package or backport fixes differently.
Which X.Org versions contain the latest listed fixes?
The X.Org security index reviewed here lists the July 8, 2026 fixes in xorg-server 21.1.24 and Xwayland 24.1.13. The entry names CVE-2026-55999, a glamor Font Atlas heap buffer overflow, and CVE-2026-56000, a GLX contextTags use-after-free. Consult the linked advisory from the index for issue-specific affected-release details.
As an Amazon Associate I earn from qualifying purchases.
The index orders advisories by the most recent release they affect and cautions that issues can affect older releases, sometimes as far back as when the relevant functionality was introduced. Earlier 2026 entries give additional upstream thresholds:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11| Advisory date | Upstream fixed versions listed | Scope noted by the index |
|---|---|---|
| July 8, 2026 | xorg-server 21.1.24; Xwayland 24.1.13 | CVE-2026-55999 and CVE-2026-56000 |
| June 2, 2026 | xorg-server 21.1.23; Xwayland 24.1.12 | Several XKB, XSYNC, GLX, and DRI2 issues, including out-of-bounds access, use-after-free, and information disclosure |
| April 14, 2026 | xorg-server 21.1.22; Xwayland 24.1.10 | Issues including XKB and XSYNC flaws |
The June index entry appears to repeat a CVE identifier. Check the linked advisory rather than assuming which identifier is intended. Likewise, the phrase “a dozen vulnerabilities” should not be treated as the count for the July entry: the index separates advisories by date and component, so a count depends on which records are included.
#1 Best Overall
How to check the running server version
A system may use the X.Org X server, Xwayland, or both. Check the component relevant to the session or application; one reported version does not necessarily identify the other.
- Identify the server in use. Determine whether your session uses X.Org X server, Xwayland, or both. Do not assume a single version covers every display session.
- Inspect the reported version. X.Org documents checking server information from a client such as
xdpyinfo. The server version may also appear in logs or be available through the server’s-versionoption. See the project’s versioning documentation for details. - Check the installed package. Use your distribution’s package manager or package-information tools to find the installed xorg-server or Xwayland package and its distribution-specific release string.
- Verify the security status with your vendor. Compare the relevant upstream advisory, then check your operating system or distribution’s security notice for the installed package and its revision.
- Install available updates through the supported mechanism. If updates are held back or the system is unsupported, follow the distribution’s instructions rather than replacing system components with unofficial binaries.
The version reported by the server is useful for identification, but X.Org notes that some releases did not set the reported value correctly. It also cannot by itself establish whether a distributor has backported a security patch.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why your distribution’s package version may differ
The upstream numbers—such as xorg-server 21.1.24—identify X.Org releases. A distribution can use a different package version or revision and include security fixes without adopting the same upstream number. Conversely, seeing a version number is not enough to establish that a particular build is fixed. The deciding evidence for a system is the vendor’s security notice or package status.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsX.Org says the software stack is no longer released as one current bundle: modules are released independently. The project directs users to obtain X through their operating system or distribution vendor and says it does not provide binaries. See the X.Org project site.
Quick Recap
Best Value
Rank #4
What to do if the package is still flagged
- Check that you are looking at the advisory for the right component: X.Org X server and Xwayland have separate fixed-version thresholds.
- Look up the exact package revision and distribution release in the vendor’s security notice; do not compare only the upstream portion of a version string.
- Install the vendor-provided update and follow any restart or session guidance in its notice.
- If no fix is offered, confirm whether the distribution release remains supported and follow the vendor’s security guidance.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
