X.Org X server CVE-2026-93536

Requires an authenticated X client - a connection already authorized to the X server (typically a local user session, or an X11 session forwarded to the attacker). The specific issues add concrete prerequisites: CVE-2026-93515 needs the Present and SYNC extensions enabled (default on) plus the ability to create cross-window notifies and destroy the target window; CVE-2026-93516 needs XI2 privileges to add/remove master devices; CVE-2026-93519 needs the XFIXES and XTEST extensions (default on) and creation of more than 100 pointer barriers followed by pointer motion; CVE-2026-93517/93518/93520 need the ability to send crafted GLX or XKB requests. Limiting factors: no remote-unauthenticated path exists - the attacker must first be able to speak the X protocol to the server, which restricts exploitation to local users or environments that expose the X socket (e.g. SSH X forwarding, shared/multiseat systems). Pure-Wayland deployments without Xwayland are not exposed.

No CVSS vector, EPSS score, KEV entry, or public POC is present in the provided data, so risk must be inferred from the advisory text alone. This is an umbrella advisory covering seven memory-corruption flaws in the X.Org X server (prior to xorg-server-21.1.25) and Xwayland (prior to xwayland-24.1.14): a double free (CVE-2026-88812), two use-after-frees (CVE-2026-93515, CVE-2026-93516), and multiple heap/stack buffer overflows (CVE-2026-93517, 93518, 93519, 93520). Every issue explicitly requires an 'authenticated X client' - i.e. a client already authorized to connect to the display server, which in practice means local session access - so none are remote-unauthenticated despite the inherent severity of the memory corruption. Impact ranges from denial of service (crash) to potential arbitrary code execution; because the X server historically runs with elevated privileges, successful exploitation can mean local privilege escalation. The bugs were reported by Trend Micro ZDI (multiple ZDI-CAN IDs), which indicates credible, validated research but not necessarily public exploit code or in-the-wild use. Net: real priority for multi-user and shared-desktop environments given ubiquity of X, but the local/authenticated precondition meaningfully lowers mass-exploitation likelihood versus a network-facing CVSS-critical flaw. Note the discrepancy that the advisory text enumerates seven CVEs while this record is filed under CVE-2026-93536, and two linked diffs (present_notify.c and glamor_transfer.c) correspond to the Present UAF and an additional glamor integer-overflow fix rather than to every listed CVE - verify exact mapping with the X.Org advisory.

A local user (or a sandboxed/remote application tunneling X11, e.g. via SSH X forwarding) with an authorized connection to the X server sends crafted protocol requests - such as a malformed XkbSetGeometry TextDoodad, an oversized GLX RenderLarge request, or cross-window Present notifies followed by window destruction - to corrupt server heap memory. The attacker leverages the resulting double free, use-after-free, or buffer overflow to crash the server (DoS) or achieve arbitrary code execution in the X server's context, potentially escalating privileges. No public exploit is identified in the provided data, though the flaws were found and validated by Trend Micro ZDI.