CVE-2026-93521: 
TigerVNC 脆弱性分析と緩和策

CVE-2026-93521 is a heap-based buffer overflow vulnerability in the RandR (Resize and Rotate) extension of X.Org X Server and XWayland, enabling authenticated local X clients to crash the X server or execute arbitrary code within its context. It affects X.Org X Server versions before 21.1.25 and XWayland versions before 24.1.14. The vulnerability was disclosed on October 7, 2026, and carries a CVSS v3.1 base score of 7.8 (High) (Red Hat CVE, Red Hat Bugzilla).

The root cause lies in two bugs within the RRChangeProviderProperty() function's PropModePrepend case (CWE-787: Out-of-bounds Write; CWE-122: Heap-based Buffer Overflow). First, new_value.size is incorrectly set to len (the new data length) rather than total_len (new + existing data length), causing loss of tracking for existing property data — this also affects PropModeAppend. Second, the old_data offset is computed using prop_value->size instead of len, meaning the memory layout [new(len)][old(size)] is corrupted because old_data is placed at the wrong offset. These bugs are analogous to previously fixed issues in RRChangeOutputProperty() (commit 541ab2ecd41d). The vulnerability was discovered anonymously through Trend Micro's Zero Day Initiative (ZDI-CAN-31944) (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation allows an authenticated local X client to corrupt heap memory in the X server process, potentially enabling privilege escalation to the X server's privilege level or causing a denial of service via server crash. Since the X server often runs with elevated privileges on Linux systems, this could allow a low-privileged local user to escalate to root or a higher-privileged account. Confidentiality, integrity, and availability are all rated as High impact (Red Hat CVE, Red Hat Bugzilla).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at this time. The vulnerability requires local authenticated access to the X server, limiting the attack surface compared to remote vulnerabilities. The EPSS score is approximately 0.20%, reflecting low near-term exploitation probability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat CVE, Feedly).

1. Gain local access: Obtain a local user account on a system running a vulnerable X.Org X Server (< 21.1.25) or XWayland (< 24.1.14) with an active X session.
2. Connect as an authenticated X client: Use any standard X client library (e.g., Xlib or XCB) to connect to the running X server, as authentication is required but typically granted to local users via xauth or MIT-MAGIC-COOKIE.
3. Identify a RandR provider with properties: Query available RandR providers using RRGetProviders and RRListProviderProperties to identify a target provider and property.
4. Craft a malicious RRChangeProviderProperty request: Send a specially crafted RRChangeProviderProperty request using PropModePrepend or PropModeAppend mode with carefully sized data to trigger the incorrect buffer size calculation and corrupt the heap.
5. Trigger memory corruption: The X server miscalculates the old_data offset and new_value.size, writing data to an incorrect heap location, resulting in heap corruption.
6. Achieve code execution or crash: Depending on heap layout and exploit precision, the attacker may achieve arbitrary code execution within the X server's privilege context (potentially root) or cause a denial of service crash (Red Hat Bugzilla).

• Logs: Unexpected X server crashes or segmentation faults in system logs (e.g., /var/log/Xorg.0.log) referencing RandR or provider property operations; repeated X server restarts in a short timeframe.
• Process: Unusual child processes spawned by the X server process (e.g., shells or network tools) indicating post-exploitation activity.
• File System: Unexpected new files or modified binaries in system directories created around the time of X server crashes, potentially indicating post-exploitation persistence.
• Network: Outbound connections from the X server process to unexpected external hosts, which may indicate a reverse shell or data exfiltration following successful exploitation.

Update X.Org X Server to version 21.1.25 or later, and XWayland to version 24.1.14 or later. The upstream fix is available via GitLab commit 5dc9efd5a199717b53f70b9c6cd336a522370e46. Red Hat has issued multiple errata addressing this issue: RHSA-2026:82015 (RHEL 9), RHSA-2026:85191 (RHEL 10), RHSA-2026:85193 (RHEL 9), RHSA-2026:86907 (RHEL 8), and RHSA-2026:89747 (RHEL 8). SUSE, openSUSE, Amazon Linux, and other distributions have also released patches. As a workaround, restrict local access to X server connections where possible and apply the principle of least privilege to limit X server process permissions (Red Hat Bugzilla, Red Hat CVE).

The vulnerability was part of a broader batch of 12 CVEs patched in X.Org Server 21.1.25 and XWayland 24.1.14, which received coverage from security news outlets including Help Net Security and Gaming on Linux, noting the significance of the release due to multiple code execution flaws. The broader patch batch was described as addressing nine vulnerabilities allowing arbitrary code execution, drawing attention from the Linux security community (Help Net Security, Gaming on Linux).