ZDI-26-780: X.Org Server GestureBuildSprite Use-After-Free Information Disclosure Vulnerability
ZDI discloses a local use-after-free in X.Org Server that can leak information after low-privileged code execution.
Trend Micro's Zero Day Initiative published ZDI-26-780, a use-after-free in X.Org Server's GestureBuildSprite function. A local attacker who can already execute low-privileged code may disclose sensitive information. ZDI rated the issue CVSS 4.4 and assigned CVE-2026-93536. The advisory does not report active exploitation.
- Local use-after-free in X.Org Server GestureBuildSprite
- Attacker must already run low-privileged code
- CVSS 4.4 information disclosure, CVE-2026-93536
- No in-the-wild exploitation reported
Vulnerabilities mentionedAll →
- published —
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-93536 | NVD description · AI analysis pending | — | — | — | — | — |
This vulnerability allows local attackers to disclose sensitive information on affected installations of X.Org Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 4.4. The following CVEs are assigned: CVE-2026-93536.
This source does not provide full text. Read it at zerodayinitiative.com.