CVE-2026-93517: GLX RenderLarge copied client dataBytes into a buffer
sized by the smaller embedded cmdlen, allowing a heap buffer overflow
CVE-2026-93518: XKB size_syms/num_syms/size_acts/num_acts were 16-bit,
so resize computations truncated and caused undersized allocations and
heap overflow
CVE-2026-93519: Crossing many pointer barriers at once wrote barrier
events past the end of the fixed-size input event buffer (heap
overflow)