CVE-2026-93523: 
TigerVNC Schwachstellenanalyse und -minderung

CVE-2026-93523 is a heap-based buffer overflow vulnerability in X.Org X Server and XWayland caused by an out-of-range modifier value in a XIPassiveUngrabDevice request. It affects X.Org X Server before version 21.1.15 (and before 21.1.25 per RPM versioning) and XWayland before 24.1.14. Authenticated local X clients can exploit this flaw to crash the X server or potentially execute arbitrary code in the X server's context. The vulnerability was disclosed on October 7, 2026, and carries a CVSS v3.1 base score of 7.8 (High) (Red Hat CVE, GitHub Advisory).

The root cause lies in ProcXIPassiveUngrabDevice(), which passes client-supplied modifier values directly to DeletePassiveGrabFromList() without validation. That function may call DeleteDetailFromMask(), which uses BITCLEAR(mask, modifier) on a mask allocated as 8 Mask words (256 bits). A modifier value greater than 255 causes BITCLEAR to index mask[modifier>>5] past the allocation boundary, resulting in a controlled single-bit-clear at an attacker-chosen heap offset — a classic out-of-bounds write (CWE-787, CWE-122). The fix applies the same modifier validation used by CheckGrabValues(): rejecting modifiers that are not XIAnyModifier and have bits set outside AllModifiersMask. The vulnerability was discovered by an anonymous researcher working with Trend Micro's Zero Day Initiative (ZDI-CAN-32366) (Red Hat Bugzilla, GitHub Advisory).

A local authenticated user can trigger this vulnerability by sending a specially crafted XIPassiveUngrabDevice request with an out-of-range modifier value, enabling heap memory corruption. This can result in a denial of service (X server crash) or, in a more severe scenario, arbitrary code execution with X server privileges. The scope is limited to the local system, but successful code execution could allow privilege escalation or lateral movement within the graphical session environment (Red Hat Bugzilla, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Red Hat CVE). The vulnerability requires local authenticated access to the X server, which limits its attack surface. The EPSS score is approximately 0.202%, indicating a low near-term exploitation probability. The CVE status is currently "Awaiting Analysis" and it has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was reported through Trend Micro's Zero Day Initiative (ZDI-CAN-32366) (Red Hat Bugzilla).

1. Gain local access: Obtain a local authenticated session on a system running a vulnerable X.Org X Server (before 21.1.15) or XWayland (before 24.1.14) with access to the X display.
2. Craft malicious request: Construct an XIPassiveUngrabDevice protocol request containing a modifier value greater than 255 (e.g., 256 or higher), which bypasses the missing input validation in ProcXIPassiveUngrabDevice().
3. Trigger out-of-bounds write: Send the crafted request to the X server. The server passes the unvalidated modifier to DeletePassiveGrabFromList() → DeleteDetailFromMask(), which executes BITCLEAR(mask, modifier) and writes a single bit clear at a heap offset beyond the allocated 256-bit mask.
4. Achieve heap corruption: The controlled out-of-bounds bit-clear corrupts adjacent heap memory, potentially overwriting heap metadata or other data structures.
5. Crash or execute code: Depending on heap layout and exploitation technique, the attacker can either crash the X server (denial of service) or leverage the heap corruption to redirect execution flow and achieve code execution with X server privileges (Red Hat Bugzilla, GitHub Advisory).

• Logs: X server error logs (e.g., /var/log/Xorg.0.log) showing unexpected crashes or segmentation faults in ProcXIPassiveUngrabDevice or DeletePassiveGrabFromList; repeated X server restarts in system logs (journalctl or /var/log/messages).
• Process: Unexpected termination or restart of the Xorg or Xwayland process; unusual child processes spawned from the X server process.
• Network/IPC: Unusual X11 client connections to the display socket (e.g., /tmp/.X11-unix/X0) from unexpected processes or users, particularly those sending XIPassiveUngrabDevice requests with anomalous modifier values.
• File System: Core dump files (e.g., core.*) in the X server working directory or /var/crash/ following unexpected X server crashes.

Patches are available from multiple vendors. The upstream fix is committed to the X.Org xserver repository (GitLab commit 37a1847). Red Hat has issued multiple errata: RHSA-2026:82015 (RHEL 9), RHSA-2026:85191 (RHEL 10), RHSA-2026:85193 (RHEL 9), RHSA-2026:86907 (RHEL 8), and RHSA-2026:89747 (RHEL 8). SUSE issued SUSE-SU-2026:4636-1, SUSE-SU-2026:4645-1, SUSE-SU-2026:4663-1, and SUSE-SU-2026:4835-1. Amazon Linux advisories ALAS2-2026-4013, ALAS2023-2026-3261, and ALAS2027-2026-226 are also available. As a workaround, restrict local access to the X server and limit which authenticated clients can submit input device requests; consider running the X server with minimal privileges (Red Hat Bugzilla, Red Hat CVE).

The vulnerability was part of a broader set of security issues addressed in X.Org Server 21.1.25 and XWayland 24.1.14, which received coverage from Linux-focused outlets. Gaming on Linux noted the releases were prompted by multiple security issues, and pro-linux.de published several advisories covering the affected packages across distributions. The broader security community tracked the issue through standard vulnerability databases and scanner plugins (Nessus, Qualys), with no exceptional controversy or notable researcher commentary specific to this CVE (Gaming on Linux).