{"id":"CVE-2026-93523","kind":"vulnerability","aliases":["CVE-2026-93523"],"related":[],"title":"X.Org X Server: out-of-range modifier in XIPassiveUngrabDevice overflows heap","description":"A heap buffer overflow caused by a XIPassiveUngrabDevice request with an out-of-range modifier value in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.","summary":"A malformed XIPassiveUngrabDevice request with an out-of-range modifier value writes past a heap buffer in X.Org X Server and XWayland. An authenticated X client can crash the server or potentially execute code in the X server context.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-desktop","x.org","xorg-server","xwayland"],"not_affected_if":["no-x-server","trusted-clients-only"],"how_to_check":"- Run `Xorg -version` or `X -version` and compare with `21.1.15`\n- Run `Xwayland -version` and compare with `24.1.14`\n- Check whether the distribution's xorg-server or xwayland package includes the fix","fix":"- Update X.Org X Server to `21.1.15` or later\n- Update XWayland to `24.1.14` or later\n- Apply the distribution's xorg-server and xwayland security updates","status":"open","published_at":"2026-10-28T17:18:53+00:00","first_seen_at":"2026-10-28T17:34:10+00:00","triaged_at":"2026-10-28T17:36:16+00:00","updated_at":"2026-10-28T17:36:16+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-28T17:36:16Z","model":"claude-haiku-5-5","output":{"fix":"- Update X.Org X Server to `21.1.15` or later\n- Update XWayland to `24.1.14` or later\n- Apply the distribution's xorg-server and xwayland security updates","reach":"local","title":"X.Org X Server: out-of-range modifier in XIPassiveUngrabDevice overflows heap","impact":"high","summary":"A malformed XIPassiveUngrabDevice request with an out-of-range modifier value writes past a heap buffer in X.Org X Server and XWayland. An authenticated X client can crash the server or potentially execute code in the X server context.","category":"infrastructure","nicknames":[],"who_cares":["x.org","xwayland","linux-desktop","xorg-server"],"confidence":0.7,"needs_auth":"yes","worst_case":"Crash the X server or run code in its context","analyst_note":"Check the upstream X.Org security advisory for whether the flaw is reachable from remote X clients and whether a working exploit is public.","how_to_check":"- Run `Xorg -version` or `X -version` and compare with `21.1.15`\n- Run `Xwayland -version` and compare with `24.1.14`\n- Check whether the distribution's xorg-server or xwayland package includes the fix","needs_analyst":true,"not_affected_if":["no-x-server","trusted-clients-only"],"who_is_affected":"Systems running an X.Org X Server before 21.1.15 or XWayland before 24.1.14 where local X clients can connect. Exposure depends on whether untrusted or less-trusted clients can reach the X display. Hosts with no X server, or with X access limited to trusted users, have less exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000634,"input_tokens":3317,"output_tokens":604,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-93523':15A,18A '21.1.15':90C '24.1.14':94C 'authent':52B,99C 'buffer':44B,70C 'caus':72C 'client':54B,101C 'code':62B,107C 'context':67B,111C 'could':95C 'crash':56B,103C 'cve':13A,16A 'desktop':22B 'execut':61B,106C 'heap':12A,43B,69C 'infrastructur':19B 'linux':21B 'linux-desktop':20B 'malform':29B 'modifi':8A,38B,83C 'out-of-rang':4A,34B,79C 'overflow':11A,71C 'past':41B 'potenti':60B,105C 'rang':7A,37B,82C 'request':31B,76C 'server':3A,26B,48B,58B,66B,88C,110C 'use':97C 'valu':39B,84C 'write':40B 'x':2A,47B,53B,65B,87C,100C,109C 'x.org':1A,23B,46B,86C 'xipassiveungrabdevic':10A,30B,75C 'xorg':25B 'xorg-serv':24B 'xwayland':27B,50B,92C","nicknames":[],"mitigations":[],"who_affected":"Systems running an X.Org X Server before 21.1.15 or XWayland before 24.1.14 where local X clients can connect. Exposure depends on whether untrusted or less-trusted clients can reach the X display. Hosts with no X server, or with X access limited to trusted users, have less exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T17:18:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"meissner@suse.de","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93523","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93523","severity":null,"published_at":"2026-10-28T17:18:53+00:00","modified_at":"2026-10-28T17:18:53+00:00","first_seen_at":"2026-10-28T17:34:10+00:00","fetched_at":"2026-10-28T17:34:10+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}