CVE-2026-93524: 
TigerVNC 脆弱性分析と緩和策

CVE-2026-93524 is a buffer over-read vulnerability in the CheckKeySyms() function within the X Keyboard Extension (XKB) handling code (xkb/xkb.c) of X.Org X Server and XWayland. It affects X.Org X Server before version 21.1.25 and XWayland before version 24.1.14. Authenticated X clients can exploit this flaw to leak small amounts of heap memory from the X server or potentially crash it. The vulnerability was disclosed on October 7, 2026, and carries a CVSS v3.1 base score of 3.3 (Low) and a CVSS v4.0 base score of 6.9 (Medium) (Red Hat CVE, GitHub Advisory).

The root cause is an indexing inconsistency in CheckKeySyms() (CWE-125/CWE-126: Out-of-bounds Read / Buffer Over-read). The function contains two loops: the first processes keys in the SetMap request range using a zero-based index offset by req->firstKeySym, but the second loop — intended to fill in keys outside the request range from the existing map — incorrectly restarts at the raw loop counter i rather than req->firstKeySym + req->nKeySyms. When firstKeySym is large and nKeySyms is small, the second loop overwrites the newly computed symsPerKey[] widths with stale values from the existing keymap. CheckKeyActions() then validates the wire action count against the stale width and accepts it; SetKeySyms() widens the key (resizing actions to nGroups * newWidth), but SetKeyActions() resizes again to the old count. A subsequent XkbGetMap request reads XkbKeyNumActions() entries — derived from the new, wider key_sym_map.width — from the shorter action allocation, causing an out-of-bounds heap read whose bytes are copied into the GetMap reply and returned to the client. The fix (a single line: i = req->firstKeySym + req->nKeySyms; before the second loop) was committed to the xserver repository (Red Hat Bugzilla, GitHub Advisory).

Successful exploitation allows an authenticated local X client to read a bounded amount of heap memory from the X server process, potentially exposing sensitive in-memory data such as cryptographic material, credentials, or other process state. Additionally, the vulnerability can be used to crash the X server, causing a denial of service for all users of the display session. The impact is limited to the local system and requires an authenticated X client connection; there is no known path to remote exploitation or privilege escalation (Red Hat CVE, GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Red Hat CVE). The vulnerability was discovered by WONJOON HWANG (@joon1337) working with TrendAI Zero Day Initiative (ZDI-CAN-32408) and responsibly disclosed (Red Hat Bugzilla). The EPSS score is approximately 0.177%, indicating a low probability of exploitation in the near term. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Gain authenticated X client access: Obtain a local user account on the target system with access to the X display (e.g., via SSH with X forwarding, or a local shell session).
2. Craft a malicious XKB SetMap request: Construct an XkbSetMap request with a large firstKeySym value and a small nKeySyms value. This triggers the indexing bug in CheckKeySyms(), causing the second loop to overwrite newly computed symsPerKey[] entries with stale widths from the existing keymap.
3. Trigger the desynchronization: Send the crafted XkbSetMap request to the X server. The stale width causes CheckKeyActions() to accept an action count based on the old (narrower) key width, while SetKeySyms() widens the key to the new width — creating a mismatch between the action allocation size and the recorded key width.
4. Issue an XkbGetMap request: Send a follow-up XkbGetMap request for the affected key. The server reads XkbKeyNumActions() entries (based on the new, wider width) from the shorter action allocation, performing an out-of-bounds heap read.
5. Receive leaked heap data: The overread bytes are copied into the GetMap reply and returned to the client, disclosing a bounded amount of X server heap memory. Repeat with varying parameters to maximize information disclosure (Red Hat Bugzilla).

• Logs: Unusual or repeated XkbSetMap and XkbGetMap requests in X server logs, particularly with atypical firstKeySym/nKeySyms parameter combinations; X server crash logs or core dumps referencing xkb/xkb.c or CheckKeySyms.
• Process: Unexpected X server crashes (Xorg or Xwayland process termination) without a clear user-initiated cause, potentially indicating exploitation attempts that trigger the denial-of-service path.
• File System: Core dump files (e.g., core, Xorg.core) in /var/log/, /tmp/, or the X server working directory following unexpected crashes.

Upgrade X.Org X Server to version 21.1.25 or later, and XWayland to version 24.1.14 or later, which contain the one-line fix to CheckKeySyms() in xkb/xkb.c. Patches are available from Red Hat, SUSE, openSUSE, Amazon Linux, Oracle Linux, and other downstream distributors (Red Hat CVE, SUSE Advisory). As a workaround where patching is not immediately possible, restrict local access to the X server to trusted users only and consider disabling or limiting XKB functionality if it is not required in your environment (Red Hat Bugzilla).

The vulnerability was part of a broader X.Org security release (X Server 21.1.25 / XWayland 24.1.14) that addressed 12 CVEs, nine of which allowed arbitrary code execution, drawing significant attention from the Linux security community (Help Net Security, Gaming on Linux). CVE-2026-93524 itself received less individual attention due to its lower severity compared to the RCE-class bugs in the same release. Multiple Linux distributions including SUSE, openSUSE, Amazon Linux, Oracle Linux, and FreeBSD issued advisories and updated packages promptly following the upstream release.