X.Org X Server CVE-2026-93515

Requires an authenticated X client (a client permitted to connect to the X display) and that BOTH the Present and SYNC extensions are enabled - they are enabled by default per the advisory. The client must create cross-window Present notify entries pointing at a separate target window, then destroy that target window so the freed window_priv's un-unlinked notify entries are later traversed. Limiting factors: this is not remotely reachable without display access, so exposure depends on who can open an X connection (local users, SSH X11 forwarding, nested/sandboxed sessions, or kiosk/multi-user hosts); hardened setups that disable Present/SYNC or restrict client access reduce exposure. Affected: X.Org X server before 21.1.25 and Xwayland before 24.1.14.

No CVSS vector, EPSS score, KEV listing, or public POC is present in the input, so quantitative exploitation signals are entirely absent and risk must be inferred from the advisory text and the fix commit. The flaw is a use-after-free in the Present extension (present_clear_window_notifies() fails to unlink notify entries before freeing window_priv); the X.Org advisory limits the realistic impact to denial of service (crash) or potential information disclosure - notably it does NOT claim arbitrary code execution for this CVE, unlike sibling issues in the same advisory (e.g. the GLX RenderLarge overflow CVE-2026-93517). Exploitation requires an authenticated X client (a client already permitted to connect to the display) and both the Present and SYNC extensions, which are enabled by default - this is an authorization-scoped, typically local-access bug rather than a remote-unauthenticated one. Status: no public exploit identified at time of analysis; this is ZDI-reported (ZDI-CAN-31830) and vendor-patched, with no evidence of exploitation. Overall this is a credible but moderate-priority local privilege/stability issue for multi-user or sandbox-escape contexts, not a high-urgency internet-facing threat. Key missing data: official CVSS and CWE are N/A in the input, so severity scoring here is independently assessed and should be reconciled with the eventual NVD/vendor score.

A local or otherwise authorized X client connects to the X server, creates cross-window Present notify registrations referencing another window, then destroys the target window so that stale notify list entries are later traversed against freed memory. The resulting use-after-free crashes the X server (disrupting the entire graphical session) or may leak adjacent heap contents; no public exploit code is known, and triggering requires a client already authenticated to the display.