CVE-2026-93524:

Check your X.Org server version because a dozen vulnerabilities have been patched

X.Org patched 12 X server and Xwayland flaws, including nine that can allow arbitrary code execution.

X.Org fixed 12 security flaws in the X server and Xwayland, released in xorg-server 21.1.25 and xwayland 24.1.14. Nine can lead to arbitrary code execution, while the other three can crash the server or disclose information. The bugs include seven buffer overflows or out-of-bounds writes, three use-after-free issues, one double free, and one out-of-bounds read; ten say an authenticated X client can trigger the flaw. CVE-2026-93522, a heap overflow in Glamor CopyArea, affects only Xwayland, and CVE-2026-93520 and CVE-2026-93521 finish incomplete earlier fixes.

Help Net SecurityOct 7, 03:58 UTC · 9d agoVulnerability CVE-2026-93515 CVE-2026-93519 CVE-2026-93520+4 CVEs2

ZDI-26-769: X.Org Server XKB XkbSetMap Request Out-Of-Bounds Read Information Disclosure Vulnerability

ZDI reports a local out-of-bounds read in X.Org Server XKB that can disclose information, CVE-2026-93524.

The Zero Day Initiative published ZDI-26-769 for CVE-2026-93524, an out-of-bounds read in X.Org Server's XKB XkbSetMap request handling. A local attacker who can already execute low-privileged code may disclose sensitive information. ZDI assigned a CVSS score of 6.1. No in-the-wild exploitation is mentioned.

ZDI Published AdvisoriesOct 15, 05:00 UTC · 1d agoVulnerability CVE-2026-935241

CVE-2026-93524

In the news2 stories

Check your X.Org server version because a dozen vulnerabilities have been patched

ZDI-26-769: X.Org Server XKB XkbSetMap Request Out-Of-Bounds Read Information Disclosure Vulnerability