X.Org X Server CVE-2026-93519

Requires the attacker to be a connected X client on the target X server/Xwayland session (local or session-level display access), per the advisory which describes an 'authenticated X client'; it is not remotely exploitable without such a foothold. The specific trigger is creating more than 100 pointer barriers through the XFIXES extension and then generating pointer motion events (e.g. via the XTEST extension) so that input_constrain_cursor() writes past the fixed-size event buffer. Both XFIXES and XTEST are enabled by default, so no non-default configuration is needed. Limiting factors: the attacker must already be able to talk to the X server (no pure-remote vector), affected versions are X server prior to 21.1.25 and Xwayland prior to 24.1.14, and no user interaction beyond the attacker's own barrier/motion actions is required.

No CVSS vector, EPSS score, KEV entry, or public POC was provided in the input, so quantitative exploitation signals are absent and must be inferred from the advisory text. This is a stack/heap buffer overflow in the X.Org X server and Xwayland (input_constrain_cursor) that the advisory states can lead to arbitrary code execution. The X server frequently runs with elevated privileges (historically root, or with device access on seat managers), so successful code execution can translate to local privilege escalation - raising its practical impact above a simple DoS. However, the attack requires a foothold as an X client with an active X session/display connection, which bounds real-world risk to local or session-level attackers rather than remote internet-facing exposure. Exploitation status: no public exploit identified at time of analysis; the issue was reported privately through Trend/ZDI (ZDI-CAN-31938), indicating it is not known to be actively exploited. Net assessment: a credible local privilege-escalation / DoS primitive worth prioritizing on multi-user or kiosk Linux systems, but not an internet-wide emergency. Note: the advisory says the attacking client must be connected/authenticated, but no CVSS vector was supplied to independently confirm the privilege level, so the authentication requirement is taken from the description text rather than a verified vector.

A local or session-level attacker who can open a connection to the running X server (e.g. a logged-in user, a compromised desktop application, or a malicious process sharing the display) creates more than 100 pointer barriers via the XFIXES extension, then uses XTEST to synthesize pointer motion events. The resulting writes overflow the fixed-size barrier event buffer in input_constrain_cursor(), corrupting memory in the X server process and potentially yielding code execution in the server's (often privileged) context. No public exploit is currently known; discovery was via ZDI.