X.Org X Server CVE-2026-93518
CRITICALVulnerability Assessment
| Impact | No CVSS, EPSS, KEV, or POC data was supplied for this CVE, so quantitative exploitation signals are entirely absent and the following is inferred from the X.Org advisory text plus my own CVSS assessment. The flaw is a classic integer-truncation heap overflow: in XkbResizeKeyType() the expression (nTotal * 15) / 10 is assigned to an unsigned short (size_syms), wrapping past 65535 and producing an undersized allocation that subsequent writes overflow - a memory-corruption primitive the vendor states can yield arbitrary code execution or a crash. Crucially, this is an X-server-protocol bug: the attacker must be a connected X client, which makes the realistic attack vector local (display/session access) rather than network, so I assess AV:L/PR:L - NOT a remote unauthenticated issue despite 'code execution' language. Exploitation status is 'no public exploit identified at time of analysis'; it was reported privately through Trend/ZDI (ZDI-CAN-31834), which argues against in-the-wild activity but reflects a credibly exploitable primitive. Net priority: moderate-to-high on multi-user, kiosk, or sandboxed-GUI hosts (where an untrusted local client or escaped sandbox could reach the X server, historically a high-privilege process) and for local privilege escalation / sandbox-escape chains; low priority as an internet-facing mass-exploitation risk. Key missing data: official CVSS vector, CWE (this is CWE-190→CWE-787), EPSS, and any downstream-distro severity rating - these should be confirmed against the eventual NVD/distro entries. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Heap buffer overflow in X.Org X Server versions prior to 21.1.25 and in Xwayland prior to 24.1.14 stems from an integer truncation inside XkbResizeKeyType(), where the computed key-symbol count is stored in an unsigned short and wraps for sufficiently large nTotal values, yielding an undersized allocation that subsequent writes overflow. The X.Org advisory of October 2026 states the trigger is an X client sending crafted XKB requests that resize a key type with a large nTotal; because no CVSS vector was supplied, authentication requirements are not confirmed from available data, and the advisory's own phrasing describes the actor as an authenticated X client. No CVSS score, EPSS estimate, CISA KEV listing, or public exploit code was available at time of analysis, so no public exploit identified at time of analysis; the vendor assesses the impact as heap corruption that can lead to arbitrary code execution or denial of service. This CVE is one of seven flaws disclosed together in the same X.Org security advisory.
RemediationAI
Apply the vendor-released patch by upgrading to xorg-server 21.1.25 or later, and to xwayland 24.1.14 or later; the upstream fix for this specific truncation is commit 89101a6c6618, and the same release also closes the six other flaws in the advisory, so a single upgrade covers the whole batch. On Wayland systems, note that Xwayland is usually shipped by the compositor's packaging (GNOME, KDE, wlroots-based compositors), so updating the compositor stack may be required rather than updating an Xorg package. If immediate patching is not possible, the practical compensating controls are all variations on reducing who can reach the X display: stop exposing the server over TCP (run with -nolisten tcp and ensure X11 forwarding is not enabled on SSH), restrict display access to trusted local users via Xauthority and filesystem permissions on /tmp/.X11-unix, and never run untrusted or third-party X clients against a production display, since the advisory treats an attacker-controlled client as the trigger. For high-assurance environments, run untrusted X applications inside a nested or isolated server (Xephyr, Xpra, or a separate Xwayland instance in a sandbox) and confine the real server with SELinux/AppArmor so a compromised client cannot reach the production display; the trade-off is reduced compatibility and performance for accelerated graphics and clipboard/drag-and-drop integration. Disabling XKB is not a viable mitigation because it is effectively core to keyboard handling and would break input on most systems.
Affected ProductsAI
Affected software is the X.Org X server at all versions prior to xorg-server-21.1.25, and Xwayland at all versions prior to xwayland-24.1.14; no CPE strings were supplied with this record, so coverage should be confirmed against distribution packaging. Because Xwayland is the X11 compatibility layer embedded in Wayland compositors, every desktop or appliance image bundling Xwayland below 24.1.14 is in scope, as is every host or container running a standalone Xorg server below 21.1.25, including thin-client, VDI, and remote-X deployments. The vendor advisory is published on the oss-security list at https://seclists.org/oss-sec/2026/q4/82, and the upstream patch for this CVE is https://gitlab.freedesktop.org/xorg/xserver/-/commit/89101a6c6618, with an additional referenced change at https://gitlab.freedesktop.org/xorg/xserver/-/commit/ad26c26bf795. Downstream distributions that backport rather than rebase will track their own patched builds, so verify the actual server binary version rather than the package version alone.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The X Keyboard Extension (XKB) is a core protocol extension of the X11 server that clients use to query and reconfigure the keyboard map, key types, and geometry. XkbResizeKeyType() recalculates the allocation needed for a key type's symbol array; the surrounding code declares size_syms as an unsigned short and computes the needed count with the expression (nTotal * 15) / 10, which exceeds 65535 once nTotal grows large, so the assignment silently truncates. The truncated value is used as an allocation size while the full, untruncated count governs subsequent writes, producing a classic integer-truncation-to-heap-overflow chain (CWE-197 class root cause manifesting as a heap-based buffer overflow). The affected code path is reachable through ordinary XKB protocol requests handled by the X server itself, which means every client that can reach the display connection is a potential attacker surface; the advisory notes that the same October 2026 release batch (xorg-server 21.1.25 / xwayland 24.1.14) also fixes double-free, use-after-free, and other overflow defects in XKB SetGeometry, Present cross-window notifies, XInput passive grabs, GLX RenderLarge, XFixes pointer barriers, and XKB ChangeKeycodeRange. The upstream fix for this specific issue is commit 89101a6c6618 in the xorg/xserver GitLab repository, and a related commit ad26c26bf795 appears in the reference set; both point to the same upstream hardening effort rather than to a tagged distro build.
Know when Gitlab gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Description PRE-NVD
Zero Day Initiative Advisories
Executive ViewAI
A critical heap buffer overflow in X.Org X Server versions prior to 21.1.25 and Xwayland versions prior to 24.1.14 could allow a crafted XKB request to corrupt memory, leading to arbitrary code execution or denial of service. These components are widely deployed across Linux desktops, remote access gateways, and containerized environments, so a successful attack could compromise user sessions and critical workloads. With no vendor-released patch identified at time of analysis and no public exploit identified at time of analysis, leadership should prioritize restricting untrusted X client access and monitoring for vendor updates.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict X server access to trusted clients only via Xauthority and disable xhost; disable the XKB extension if feasible; run X.Org X Server and Xwayland with least privilege and under SELinux or AppArmor confinement; isolate Xwayland in containers or dedicated user sessions; use Wayland without Xwayland for untrusted workloads; monitor for crashes and anomalous XKB requests.
Threat Intelligence Overview
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. Rated critical severity (CVSS 10
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab af
Unauthenticated arbitrary file read in GitLab CE/EE lets remote attackers retrieve files from the GitLab server via the
The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x
A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows
Remote code execution in GitLab CE/EE (all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2)
Sensitive credential and configuration disclosure in GitLab Enterprise Edition allows an authenticated user with Duo Cha
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Authenticated code execution on the GitLab server is possible in GitLab CE/EE 19.2 through 19.4.0, where an integer over
Authenticated users who can define or modify a CI/CD configuration can achieve remote code execution on GitLab CE/EE ser
Unauthenticated path traversal in the @zereight/mcp-gitlab Model Context Protocol server prior to version 2.1.27 allows
GitHub PoC
Exploit-DB