ZDI-26-759: X.Org Server XKB TextDoodad Double Free Privilege Escalation Vulnerability
ZDI discloses a local X.Org Server XKB double-free that can escalate privileges.
ZDI advisory ZDI-26-759 describes a double-free in X.Org Server XKB TextDoodad handling that can escalate privileges. A local attacker must already be able to run low-privileged code on the system. ZDI assigns CVSS 7.8 and CVE-2026-88812. The advisory does not state that exploitation has been observed.
- Double-free in X.Org Server XKB TextDoodad handling
- Local privilege escalation from existing low-privileged code
- ZDI CVSS 7.8; tracked as CVE-2026-88812
- Active exploitation is not reported
Vulnerabilities mentionedAll →
- published —
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-88812 | NVD description · AI analysis pending | — | — | — | — | — |
This vulnerability allows local attackers to escalate privileges on affected installations of X.Org Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-88812.
This source does not provide full text. Read it at zerodayinitiative.com.