ZDI-26-761: X.Org Server XInput Passive Grab Use-After-Free Information Disclosure Vulnerability
ZDI disclosed an X.Org Server XInput use-after-free that can leak information to local attackers.
Trend Micro's Zero Day Initiative published ZDI-26-761, a use-after-free in X.Org Server XInput passive grab handling. A local attacker who can already run low-privileged code can disclose sensitive information on affected installations. ZDI assigned CVSS 5.5 and CVE-2026-93516. The advisory does not report exploitation in the wild.
- Use-after-free in XInput passive grab handling
- Local information disclosure after low-privileged code execution
- ZDI CVSS 5.5, tracked as CVE-2026-93516
- No in-the-wild exploitation is stated
Vulnerabilities mentionedAll →
- published —
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-93516 | NVD description · AI analysis pending | — | — | — | — | — |
This vulnerability allows local attackers to disclose sensitive information on affected installations of X.Org Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.5. The following CVEs are assigned: CVE-2026-93516.
This source does not provide full text. Read it at zerodayinitiative.com.