X.Org X Server CVE-2026-93524

Requires an authenticated X client connection to the X.Org X server or Xwayland (i.e. the attacker must already be able to open and authenticate to the local display socket), so this is a local, post-authentication primitive rather than remote unauthenticated access. For sibling issues in the same advisory, additional preconditions apply (e.g. Present and SYNC extensions enabled - on by default; XI2 master-device add/remove capability; XFIXES plus XTEST for the pointer-barrier overflow), all of which are default-enabled extensions. The specific trigger conditions for CVE-2026-93524 are not stated in the provided advisory text and should be verified against the X.Org advisory and the upstream commits. Limiting factors: attacker must already have a foothold capable of reaching the X server, affected versions are xorg-server prior to 21.1.25 and Xwayland prior to 24.1.14, and exploitation for code execution (versus crash) requires defeating heap layout protections.

No CVSS vector, EPSS score, KEV listing, or public POC is present in the provided data, so quantitative exploitation signals are entirely absent and risk must be inferred from the advisory text. CRITICAL CAVEAT: CVE-2026-93524 is NOT individually described in the supplied advisory body - the text enumerates CVE-2026-88812 through CVE-2026-93520 and then truncates, so the specific defect for -93524 is not visible and this assessment treats it as a member of the same October 7, 2026 X.Org batch (memory-corruption class, fixed in xorg-server-21.1.25 / xwayland-24.1.14). Across the batch, every issue explicitly requires an AUTHENTICATED X client and is triggered via crafted protocol requests to the local display server, which points to a local attack vector with low-level privileges rather than remote unauthenticated compromise - this materially lowers real-world risk versus the 'arbitrary code execution' impact wording suggests. These are credible privilege-escalation / DoS primitives (double-free, use-after-free, heap overflow) discovered by Trend/ZDI researchers, which indicates quality but NOT active exploitation. Net: a real priority for multi-user or sandbox-boundary systems where untrusted code can reach the X socket, but likely lower urgency on single-user desktops where any local X client is already running as the user. Exploitation status: no public exploit identified at time of analysis.

A local or sandboxed process able to open a connection to the X server (an authenticated X client) sends a crafted sequence of protocol requests - in the batch these include malformed XKB geometry/key-type requests, GLX RenderLarge, XInput passive grabs, or XFixes pointer barriers - to corrupt server heap memory. Because the X server typically runs with elevated privileges, successful memory-corruption exploitation could escalate to code execution in the server context, while a failed or simpler attempt crashes the server (DoS). No public exploit code is identified; the issues were reported privately through Trend/ZDI.