ZDI discloses ten local X.Org Server flaws

ZDI published ten local X.Org Server bugs, eight privilege escalations and two information leaks, with no exploitation reported.

On 15 October 2026, Trend Micro's Zero Day Initiative published ten advisories covering local vulnerabilities in the X.Org Server. Eight are privilege-escalation flaws rated CVSS 7.8: an XKB heap overflow (CVE-2026-93520, ZDI-26-765), an XKB TextDoodad double-free (CVE-2026-88812, ZDI-26-759), a GLX RenderLarge heap overflow (CVE-2026-93517, ZDI-26-762), numeric truncation in XKB XkbResizeKeyType (CVE-2026-93518, ZDI-26-763), an XFixes Pointer Barrier heap overflow (CVE-2026-93519, ZDI-26-764), a RandR heap overflow (CVE-2026-93521, ZDI-26-766), a Glamor CopyArea heap overflow (CVE-2026-93522, ZDI-26-767), and an XInput ProcXI passiveUngrabDevice heap overflow (CVE-2026-93523, ZDI-26-768). Two further issues can disclose information: a Present-extension use-after-free rated CVSS 5.5 (CVE-2026-93515, ZDI-26-760) and an XKB XkbSetMap out-of-bounds read rated CVSS 6.1 (CVE-2026-93524, ZDI-26-769). All ten require existing low-privileged local code execution, and no advisory reports exploitation in the wild. The reports do not disagree on scores, CVE mappings, or exploitation status.

• On 15 October 2026, Trend Micro's Zero Day Initiative published ten advisories for local X.Org Server vulnerabilities.
• Eight privilege-escalation flaws are each rated CVSS 7.8: CVE-2026-93520 (ZDI-26-765, XKB heap overflow), CVE-2026-88812 (ZDI-26-759, XKB TextDoodad double-free), CVE-2026-93517 (ZDI-26-762, GLX RenderLarge heap overflow), CVE-2026-93518…
• Two information-disclosure flaws: CVE-2026-93515 (ZDI-26-760, Present-extension use-after-free, CVSS 5.5) and CVE-2026-93524 (ZDI-26-769, XKB XkbSetMap out-of-bounds read, CVSS 6.1).
• Every issue requires an attacker who can already execute low-privileged local code.
• None of the advisories reports exploitation in the wild.