X.Org X Server CVE-2026-93516
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessConnect as authenticated X client
-
DeliveryCreate XI2 passive grab with master as modifierDevice
-
ExploitCall XIRemoveMaster to free device
-
ExecutionTrigger operation dereferencing dangling pointer
-
PersistUse-after-free corrupts heap
-
ImpactCrash or execute code in X server
Vulnerability Assessment
| Exploitation Conditions | Requires an authenticated client connection to the X server/Xwayland display plus the XInput2 (XI2) extension, which is enabled by default. The specific precondition is the ability to add and remove master devices: the attacker creates a passive grab whose modifierDevice is a master device, then issues XIRemoveMaster to free that device, after which any input operation dereferencing the stale pointer triggers the use-after-free. Limiting factors: exploitation is not remote-unauthenticated - it needs a valid X session/display access (typically local, since modern X servers do not listen on TCP by default), and reliable arbitrary code execution (versus a simple crash) requires heap-layout control; affected only when running X server builds prior to xorg-server-21.1.25 or Xwayland prior to xwayland-24.1.14. |
| Impact | No CVSS vector, EPSS score, KEV entry, SSVC decision, or public POC is provided in the input, so the quantitative exploitation signals are entirely absent and cannot be compared - this assessment rests on the X.Org advisory text alone. Qualitatively, the flaw is a use-after-free in the X server/Xwayland XInput (XI2) passive-grab handling where GrabRec holds a raw, unmanaged DeviceIntPtr to a modifierDevice that becomes dangling after XIRemoveMaster frees the master device; the advisory states this can lead to denial of service (crash) or potentially arbitrary code execution. The advisory describes the attacker as an 'authenticated X client' with the ability to add and remove master devices, but because no CVSS vector is supplied I cannot formally confirm the privilege level per the precision rules - treat the 'authenticated' qualifier as advisory-stated, not CVSS-confirmed. Realistically this is a local privilege-escalation / DoS primitive: an X client already connected to the display can escalate toward code execution in the X server process (frequently privileged), which is a meaningful priority on multi-user or sandbox-escape scenarios rather than a remote-internet threat, since modern X servers do not listen on TCP by default. Absence of EPSS/KEV/POC is expected for a freshly disclosed (2026-10-07) ZDI-reported issue and should NOT be read as low risk - it reflects missing data, not confirmed low exploitability. |
| Exploit ScenarioDerived | A local user (or a compromised sandboxed process) with a connection to the X display creates an XI2 passive grab that references a master pointer/keyboard as its modifier device, then calls XIRemoveMaster to free that device, leaving the grab record holding a dangling pointer. Subsequent input processing dereferences the freed modifierDevice, crashing the X server or, with heap grooming, steering the use-after-free toward arbitrary code execution in the (often root-privileged) server process. No public exploit is identified at time of analysis, though the bug was found by the Trend/ZDI program (ZDI-CAN-31832). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
A use-after-free in the XInput2 passive grab handling of X.Org X server builds prior to xorg-server-21.1.25 and Xwayland prior to xwayland-24.1.14 allows an authenticated client that can add and remove XI2 master devices to crash the server or potentially achieve arbitrary code execution. The attacker creates a passive grab whose modifierDevice points at a master device, then calls XIRemoveMaster to free that device; the grab retains a dangling DeviceIntPtr that later input processing dereferences, corrupting the heap. Reaching the vulnerable code requires a valid client connection to the X server or Xwayland (typically local, since modern X servers do not listen on TCP by default) and the XI2 extension, which is enabled by default; no public exploit code and no CISA KEV entry have been identified at time of analysis.
RemediationAI
Upgrade to the vendor-released fixed versions: X.Org X server 21.1.25 or later, and Xwayland 24.1.14 or later (the advisory also points to the upstream source fix at https://gitlab.freedesktop.org/xorg/xserver/-/commit/be5726341588). Because the flaw is triggered through the XInput2 extension, sites that cannot patch immediately can disable the extension with the X server's -extension XInputExtension option for single-user, fixed-input kiosk or appliance hosts - but this is a heavy workaround: it removes XI2-based hotplug, modern input-driver and touchpad handling, and breaks toolkits and compositors that rely on XI2, so it is unsuitable for general desktops. A less disruptive compensating control is to restrict who can open a client connection at all: keep -nolisten tcp in effect, tighten Xauthority cookie and abstract-socket permissions (e.g. 0700 on the X socket and per-user xhost/xauth discipline), avoid granting untrusted clients display access, and confine untrusted applications in sandboxes that proxy through a separate, patched server. Additionally, XIRemoveMaster is an administrative operation, so auditing or restricting local users permitted to run privileged XI2 device-management tooling reduces exposure, though it will not stop an attacker who already has a legitimate client connection. None of these compensating controls address the underlying dangling pointer, and each carries the trade-off noted above - patching to xorg-server 21.1.25 / xwayland 24.1.14 remains the only complete fix.
Affected ProductsAI
The issue affects X.Org X server releases prior to xorg-server-21.1.25 and Xwayland releases prior to xwayland-24.1.14; the advisory covers both code bases because the XInput/grab logic is shared. Any deployment in which untrusted or semi-trusted local clients can obtain a connection to the display - multi-user workstations, thin clients, remote-access setups that forward or proxy the X socket, and Xwayland sessions running sandboxed applications - is in scope, and exploitation additionally requires the XInput2 extension (enabled by default) plus the ability to create and destroy XI2 master devices. No CPE identifiers were provided with the source data, so affected inventory should be matched on the xorg-server (< 21.1.25) and xwayland (< 24.1.14) version strings. The vendor advisory is the oss-security posting at https://seclists.org/oss-sec/2026/q4/82, and the corresponding source fix referenced by the advisory is the upstream commit https://gitlab.freedesktop.org/xorg/xserver/-/commit/be5726341588 (note that the fix commit URLs supplied in this record's reference list, 1b6955c3108e, ad26c26bf795 and 89101a6c6618, correspond to other CVEs in the same advisory, not to CVE-2026-93516).
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
X.Org's XInput2 (XI2) extension models input as a hierarchy of master devices (the virtual pointer/keyboard that clients see) and slave devices (physical devices attached to a master). Input grabs are recorded in GrabRec structures, and for modifier grabs the record stores a raw DeviceIntPtr to the device acting as the modifier device rather than a reference-counted or generational handle. When a client calls XIRemoveMaster, the server frees the master DeviceInt object and its associated structures, but any passive grab still referencing it as modifierDevice is not updated or invalidated, leaving a dangling pointer. Any subsequent code path that dereferences that pointer reads freed memory - the classic use-after-free class (typically catalogued as CWE-416) - which in this case manifests as heap corruption that can produce either a server crash or, with sufficient heap-layout grooming, control-flow hijack in the X server process. The defect is one of a batch of memory-safety issues disclosed together in the October 07, 2026 X.Org security advisory affecting the same two code bases (xorg-server and its Wayland counterpart Xwayland, which shares the input and grab-handling code), all reported through TrendAI's Zero Day Initiative (this one as ZDI-CAN-31832). The supplied record contains no CPE strings, no CVSS vector in the vendor data, and no CWE ID; the assessed vector below was produced by our own analysis.
Know when Gitlab gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L because X clients normally connect over a local socket (no default TCP); PR:L as a connected/authenticated X client is required; AC:L given the deterministic trigger sequence; C/I/A:H for potential code execution in the X server.
Estimated by vuln.today — no official severity rating has been published for this CVE yet.
Description PRE-NVD
Zero Day Initiative Advisories
Executive ViewAI
CVE-2026-93516 is a use-after-free flaw in the X.Org X server (builds prior to xorg-server-21.1.25) and Xwayland (builds prior to xwayland-24.1.14), the display layers present on most Linux workstations, virtual desktop images, and Linux-based appliances. A client that already holds a connection to the display server can trigger the flaw to crash the graphical session, or potentially execute code in the server process, which in some deployments runs with elevated privileges. No vendor patch and no public exploit have been identified at time of analysis, so this is a contained but unresolved exposure that requires inventory and interim hardening rather than emergency response.
No vendor-released patch identified at time of analysis. Interim mitigations: confirm the X server is not listening on TCP and keep connections local and restricted via Xauthority/xhost policy; limit which accounts and processes can open a client connection to the display server, particularly on multi-user or shared-workstation systems; confine untrusted code (browsers, containers, sandboxed applications) so it cannot reach the X socket; prefer Wayland/Xwayland configurations with the fewest legacy X clients; monitor for unexplained X server or Xwayland crashes and treat repeat occurrences as potential exploitation attempts; and track upstream and distribution advisories for xorg-server-21.1.25 and xwayland-24.1.14 and apply them as soon as they are available and validated.
Threat Intelligence Overview
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. Rated critical severity (CVSS 10
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab af
Unauthenticated arbitrary file read in GitLab CE/EE lets remote attackers retrieve files from the GitLab server via the
The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x
A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows
Remote code execution in GitLab CE/EE (all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2)
Sensitive credential and configuration disclosure in GitLab Enterprise Edition allows an authenticated user with Duo Cha
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Authenticated code execution on the GitLab server is possible in GitLab CE/EE 19.2 through 19.4.0, where an integer over
Authenticated users who can define or modify a CI/CD configuration can achieve remote code execution on GitLab CE/EE ser
Unauthenticated path traversal in the @zereight/mcp-gitlab Model Context Protocol server prior to version 2.1.27 allows
GitHub PoC
Exploit-DB