X.Org X Server CVE-2026-93523

Based on the inferred glamor mapping: exploitation requires an X server built with glamor (GPU-accelerated 2D) support and an attacker who is an already-authenticated local X client with access to the running display. The concrete trigger is an image-upload through glamor_upload_boxes against a drawable whose effective depth is 24 while the backing pixmap depth is 32, with byte_stride * height large enough to overflow INT_MAX and cause an undersized heap allocation. Limiting factors that reduce real-world risk: local display access is mandatory (no network vector in default builds, which do not listen on TCP), glamor acceleration must be in use, the specific depth mismatch must occur, and the dimensions needed to overflow a 32-bit size calculation are very large - making reliable exploitation high-complexity. This mapping is unverified because CVE-2026-93523's own description is missing from the input.

No CVSS vector, EPSS score, KEV entry, or POC flag was supplied in the input, so quantitative exploitation signals are entirely absent and cannot be compared or contrasted - risk must be reasoned from the X.Org advisory text and fix commits alone. CRITICAL CAVEAT: the specific description for CVE-2026-93523 is NOT present in the provided advisory, which enumerates sibling CVEs CVE-2026-88812 through CVE-2026-93520 and then truncates; the most likely match for CVE-2026-93523 is the glamor_upload_boxes integer-overflow fix shown in linked diff 2 (glamor/glamor_transfer.c), where byte_stride * tmp_height could overflow INT_MAX and produce an undersized XNFalloc heap allocation followed by an out-of-bounds write. Under that reading the flaw is a local, authenticated memory-corruption bug in the X server: consistent with the whole advisory batch, every issue requires an 'authenticated X client' (a process already connected to the display), so this is a local-privilege/DoS class problem, not a remotely-wormable one. Real-world priority is moderate rather than urgent - exploitation requires local display access, the glamor path requires a depth-24-drawable/depth-32-pixmap mismatch and extremely large dimensions to overflow a 32-bit size, and no active exploitation or public exploit is indicated - but the impact ceiling is high because X servers frequently run with elevated privileges, so a successful heap overflow can escalate to code execution. The CVE-to-description mapping must be verified against the full X.Org advisory and the ad26c26bf795 commit before operational action.

A local user already authorized to the X display connects as an X client and drives image-upload operations through the glamor acceleration path against a depth-24 drawable backed by a depth-32 pixmap with dimensions large enough that byte_stride multiplied by height exceeds INT_MAX. The resulting integer truncation yields an undersized heap buffer, and the subsequent copy overflows it, potentially corrupting the heap of a privileged X server process. No public exploit was identified in the provided data, and the high attack complexity (specific depth mismatch plus very large allocation math) limits reliability.