ZDI-26-766: X.Org Server RandR Heap-based Buffer Overflow Privilege Escalation Vulnerability
ZDI disclosed a local RandR heap overflow in X.Org Server that allows privilege escalation.
The Zero Day Initiative published ZDI-26-766, a heap-based buffer overflow in the X.Org Server RandR component. A local attacker who already has low-privileged code execution can use it to escalate privileges. ZDI assigned a CVSS score of 7.8 and CVE-2026-93521. The write-up does not state that exploitation has been observed.
- Heap overflow in the X.Org Server RandR extension.
- Attacker needs existing low-privileged local execution.
- ZDI CVSS 7.8; tracked as CVE-2026-93521.
- Advisory does not claim active exploitation.
Vulnerabilities mentionedAll →
- published —
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-93521 | NVD description · AI analysis pending | — | — | — | — | — |
This vulnerability allows local attackers to escalate privileges on affected installations of X.Org Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-93521.
This source does not provide full text. Read it at zerodayinitiative.com.