ZDI-26-768: X.Org Server XInput ProcXIPassiveUngrabDevice Heap-based Buffer Overflow Privilege Escalation Vulnerability
ZDI disclosed a local heap overflow in X.Org Server XInput that can escalate privileges.
The Zero Day Initiative published ZDI-26-768, a heap-based buffer overflow in the X.Org Server XInput ProcXI passiveUngrabDevice handler. A local attacker who can already execute low-privileged code may escalate privileges on affected installations. ZDI assigned CVSS 7.8 and CVE-2026-93523. The advisory does not report active exploitation.
- Heap overflow in X.Org Server XInput ProcXI passiveUngrabDevice.
- Local attacker must already run low-privileged code.
- ZDI CVSS 7.8; tracked as CVE-2026-93523.
- No in-the-wild exploitation is reported.
Vulnerabilities mentionedAll →
- published —
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-93523 | NVD description · AI analysis pending | — | — | — | — | — |
This vulnerability allows local attackers to escalate privileges on affected installations of X.Org Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-93523.
This source does not provide full text. Read it at zerodayinitiative.com.