In the GLX RenderLarge request handling, the buffer is allocated to the size of cmdlen but the subsequent memcpy copies dataBytes into it. There is no validation that dataBytes is less than or equal to cmdlen, allowing an attacker to write past the end of the allocated buffer.

An authenticated X client can trigger this by sending a crafted GLX RenderLarge request where dataBytes exceeds cmdlen, causing a heap buffer overflow.
The heap buffer overflow can lead to arbitrary code execution or denial of service.

NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/3961cdca467975a7d377f1f7bcd55d52eb3f417a (xorg-server-21.1.25)