X.Org X Server CVE-2026-93520

Requires an already-connected, authorized X client (local session or an X connection the attacker controls) able to issue XKB protocol requests; it is triggered specifically by an XkbChangeKeycodeRange request that sets the keycode range such that MAP_LENGTH exceeds max_key_code+1, causing XkbAllocNames to under-allocate names->keys while the ChangeKeycodeRange memset writes MAP_LENGTH bytes. The principal limiting factor is that the attacker must already have access to the X display rather than mere network reachability, so exploitation presupposes a local login, a compromised GUI application, or a forwarded X session; no special non-default extension or configuration is required beyond standard XKB support. (The advisory description for this CVE is truncated in the input at 'denial of s', but the mechanism is fully stated.)

No CVSS vector, EPSS score, KEV listing, or public POC is present in the supplied data, so quantitative exploitation signals are entirely absent and cannot be compared - this assessment rests solely on the X.Org advisory text. The vulnerability is a heap out-of-bounds write in XkbAllocNames reached via the ChangeKeycodeRange path, stemming from an incomplete prior fix (commit a3171732d); the advisory itself rates the outcome as potential arbitrary code execution or denial of service. The decisive limiting factor is that the advisory states exploitation requires an 'authenticated X client' - i.e. an entity already able to connect to and speak the X protocol with the display - which makes this fundamentally a local/privilege-context issue rather than a remote-unauthenticated one; note that per analysis rules the auth qualifier cannot be formally confirmed because no CVSS vector was provided. Realistically this is a meaningful local privilege-escalation / sandbox-escape primitive (memory corruption in a long-lived, often elevated process) but not a drive-by remote threat, so it should be patched on multi-user or sandboxed hosts yet does not carry the emergency profile of a network-reachable unauthenticated RCE. Because it is one of seven memory-corruption bugs in a single coordinated X.Org advisory, prioritize the advisory as a bundle rather than this CVE in isolation.

A local user or a confined application that holds a connection to the X server sends crafted XKB requests that change the keycode range to a value where MAP_LENGTH exceeds max_key_code+1, triggering a heap out-of-bounds write during the undersized names->keys allocation. By grooming the heap the attacker can corrupt adjacent allocations to crash the server (DoS) or potentially achieve arbitrary code execution in the X server's context. No public exploit identified at time of analysis, though the bug was reported through Trend/ZDI (ZDI-CAN series).