{"id":"CVE-2026-93521","kind":"vulnerability","aliases":["CVE-2026-93521"],"related":[],"title":"X.Org X Server: RandR request overflow lets a client crash or run code","description":"A buffer overflow in RandR\nChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14 could be used by authenticated X clients to crash or execute code within the X server context.","summary":"A buffer overflow in the RandR ChangeProviderProperty request in X.Org X Server before 2.1.25 and XWayland before 24.4.14 lets an authenticated X client crash the server or execute code in its context. The attacker needs only a connection to the X server as a client.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-desktop","workstation","x.org","xwayland"],"not_affected_if":["headless-server","no-x-server"],"how_to_check":"- Run `Xorg -version` or `X -version` and compare against `2.1.25` for X.Org Server and `24.4.14` for XWayland\n- Run `Xwayland -version` on Wayland sessions that use XWayland\n- unknown for other checks, since the sources do not name a configuration","fix":"- Upgrade X.Org X Server to `2.1.25` or later\n- Upgrade XWayland to `24.4.14` or later\n- Install the fixed packages from your distribution once it ships them","status":"open","published_at":"2026-10-28T16:17:10+00:00","first_seen_at":"2026-10-28T16:33:49+00:00","triaged_at":"2026-10-28T16:35:50+00:00","updated_at":"2026-10-28T16:35:50+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-28T16:35:50Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade X.Org X Server to `2.1.25` or later\n- Upgrade XWayland to `24.4.14` or later\n- Install the fixed packages from your distribution once it ships them","reach":"local","title":"X.Org X Server: RandR request overflow lets a client crash or run code","impact":"high","summary":"A buffer overflow in the RandR ChangeProviderProperty request in X.Org X Server before 2.1.25 and XWayland before 24.4.14 lets an authenticated X client crash the server or execute code in its context. The attacker needs only a connection to the X server as a client.","category":"infrastructure","nicknames":[],"who_cares":["x.org","xwayland","linux-desktop","workstation"],"confidence":0.7,"needs_auth":"yes","worst_case":"code runs in the X server context, which usually runs as root","analyst_note":"Confirm the distribution package versions and whether XWayland exposure differs on the NVD page for CVE-2026-93521.","how_to_check":"- Run `Xorg -version` or `X -version` and compare against `2.1.25` for X.Org Server and `24.4.14` for XWayland\n- Run `Xwayland -version` on Wayland sessions that use XWayland\n- unknown for other checks, since the sources do not name a configuration","needs_analyst":true,"not_affected_if":["no-x-server","headless-server"],"who_is_affected":"Systems running X.Org X Server before 2.1.25 or XWayland before 24.4.14, including Linux desktops and workstations with an X session. Hosts that run no X server or XWayland, such as headless servers, can skip it. The sources do not say whether a default configuration is affected beyond running the server.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000641,"input_tokens":3302,"output_tokens":622,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-93521':16A,19A '2.1.25':40B,84C '24.4.14':44B,88C 'attack':60B 'authent':47B,93C 'buffer':28B,73C 'changeproviderproperti':33B,77C 'client':9A,49B,71B,95C 'code':13A,55B,100C 'connect':64B 'context':58B,105C 'could':89C 'crash':10A,50B,97C 'cve':14A,17A 'desktop':23B 'execut':54B,99C 'infrastructur':20B 'let':7A,45B 'linux':22B 'linux-desktop':21B 'need':61B 'overflow':6A,29B,74C 'randr':4A,32B,76C 'request':5A,34B,78C 'run':12A 'server':3A,38B,52B,68B,82C,104C 'use':91C 'within':101C 'workstat':24B 'x':2A,37B,48B,67B,81C,94C,103C 'x.org':1A,25B,36B,80C 'xwayland':26B,42B,86C","nicknames":[],"mitigations":[],"who_affected":"Systems running X.Org X Server before 2.1.25 or XWayland before 24.4.14, including Linux desktops and workstations with an X session. Hosts that run no X server or XWayland, such as headless servers, can skip it. The sources do not say whether a default configuration is affected beyond running the server.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T16:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"meissner@suse.de","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93521","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93521","severity":null,"published_at":"2026-10-28T16:17:10+00:00","modified_at":"2026-10-28T16:17:10+00:00","first_seen_at":"2026-10-28T16:33:49+00:00","fetched_at":"2026-10-28T16:33:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}