Heap Buffer Overflow in X.org X Server and XWayland
CVE-2026-93520

7.8HIGH

Key Information:

Vendor

X.org

Status
Xorg-x11-server
Xwayland
Vendor
CVE Published:
28 October 2026

What is CVE-2026-93520?

A heap buffer overflow vulnerability exists in X.org X server and XWayland due to mismatched size calculations between XkbAllocNames and ChangeKeycodeRange. This flaw affects versions of the X server prior to 2.1.25 and XWayland prior to 24.1.14. Authenticated X clients may exploit this vulnerability, leading to potential crashes or unauthorized code execution within the X server context.

Affected Version(s)

xorg-x11-server 0 < 21.1.25

xwayland 0 < 24.1.14

References

https://gitlab.freedesktop.org/xorg/xserver/-/commit/b941...
patch

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Anonymous working with TrendAI Zero Day Initiative
.