X.Org X Server CVE-2026-93521

Based on the glamor_transfer.c fix (linked article 2), exploitation appears to require an authenticated X client and a rendering path where a drawable with effective depth 24 is uploaded into a pixmap of depth 32, triggering byte_stride * height integer overflow and an undersized XNFalloc allocation in glamor_upload_boxes; glamor GL-based acceleration must be in use. LIMITING FACTORS: requires an already-authenticated local X client connection (not remote-unauthenticated by default), depends on the specific depth-mismatch upload path being reached, and requires glamor acceleration to be active. NOTE: because the per-CVE description for CVE-2026-93521 is absent from the truncated advisory, these conditions are inferred from the associated commit and should be verified against the vendor's per-CVE entry.

No CVSS vector, CWE, EPSS score, KEV entry, or public POC was provided in the input, so quantitative exploitation signals are entirely absent and cannot be compared. The risk must be inferred from the X.Org advisory text and commit diffs alone. CRITICAL DATA GAP: the supplied Description is the full multi-CVE X.Org advisory of 2026-10-07 but is truncated after CVE-2026-93520 - the specific text for CVE-2026-93521 is NOT present. Based on linked article 2 (the glamor/glamor_transfer.c commit, which adds an INT_MAX/byte_stride integer-overflow guard in glamor_upload_boxes), CVE-2026-93521 most plausibly corresponds to a glamor integer-overflow / heap out-of-bounds write in the GL upload path; this mapping is INFERRED, not confirmed. Across this advisory batch every issue requires an authenticated X client, which in default Linux desktop deployments means local session access rather than remote network reach, substantially lowering real-world risk versus a network-unauthenticated flaw. The upside for an attacker is memory corruption with potential arbitrary code execution in the X server (often running with elevated privileges), making this a credible local privilege-escalation / sandbox-escape primitive. Net: a genuine concern for multi-user and sandboxed Linux hosts, but not an internet-facing mass-exploitation threat, and no evidence of active exploitation exists in the provided data.

A local user (or compromised low-privilege process) with an authenticated connection to the X server sends crafted X protocol requests that trigger an integer overflow in glamor's upload path (depth-24 drawable copied into a depth-32 pixmap), producing an undersized allocation and a subsequent heap out-of-bounds write that corrupts server memory. No public exploit code is identified; the flaw was reported privately by TrendAI/ZDI researchers. Because exploitation requires an existing authenticated X client (local access in default configurations), it is a privilege-escalation / DoS primitive rather than a remote entry point.