CVE-2026-93536: 
TigerVNC 脆弱性分析と緩和策

CVE-2026-93536 is a use-after-free vulnerability in the X.Org X Server and XWayland arising from missing lifecycle management of gesture sprites in GestureBuildSprite(). It affects X.Org X Server before version 21.1.25 and XWayland before version 24.1.14. The vulnerability was reported on October 7, 2026, and published to the NVD on October 28, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) (Red Hat CVE, GitHub Advisory).

The root cause is that GestureBuildSprite() copies raw WindowPtr values into gesture sprite traces via CopySprite() without any reference counting or lifetime management (CWE-825: Expired Pointer Dereference; CWE-122: Heap-based Buffer Overflow). When a window is destroyed, WindowGone() only cleaned up touch sprite traces — gesture sprite traces were never checked, leaving stale WindowPtr references. When DeliverOneGestureEvent() subsequently dereferences the stale pointer via DeepestSpriteWin(&gi->sprite)->drawable.id, a use-after-free occurs, potentially leaking 4 bytes of freed memory contents. The vulnerability was discovered by researcher 4nibhal working with TrendAI Zero Day Initiative (ZDI-CAN-32753), and the fix modifies WindowGone() in Xi/exevents.c to also truncate gesture sprite traces when a window is removed. Exploitation requires local access with low privileges and has high attack complexity (Red Hat Bugzilla, GitHub Advisory).

A local attacker with low privileges can trigger this vulnerability without user interaction to cause a denial of service (X server crash) or potentially leak sensitive information from freed memory regions. The freed drawable.id field (4 bytes) can be read back, exposing heap memory contents to the attacker. In more severe scenarios, the use-after-free condition could potentially be leveraged for arbitrary code execution, though this requires high attack complexity. The scope is limited to the affected X server instance and does not directly enable lateral movement (Red Hat Bugzilla, Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting (Red Hat CVE). The vulnerability was responsibly disclosed through the Zero Day Initiative (ZDI-CAN-32753) by researcher 4nibhal. The EPSS score is approximately 0.166% (6th percentile), indicating a low near-term exploitation probability (GitHub Advisory). The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. High attack complexity and the requirement for local authenticated access further reduce practical exploitability.

1. Gain local access: Obtain a low-privilege authenticated session on a system running a vulnerable X.Org X Server (before 21.1.25) or XWayland (before 24.1.14).
2. Establish an X client connection: Connect to the X server as an authenticated X client using standard X11 APIs or toolkits.
3. Initiate a gesture sequence: Trigger an active gesture event on a target window, causing GestureBuildSprite() to copy WindowPtr references into the gesture sprite trace without reference counting.
4. Destroy the target window: While the gesture is still active, destroy or unmap the window whose pointer was captured in the gesture sprite trace. WindowGone() will not clean up the gesture sprite trace, leaving a dangling WindowPtr.
5. Trigger the use-after-free: Cause DeliverOneGestureEvent() to be invoked, which dereferences the stale WindowPtr via DeepestSpriteWin(&gi->sprite)->drawable.id, reading 4 bytes from freed memory — potentially leaking heap contents or causing a crash (Red Hat Bugzilla).

• Logs: Unexpected X server crash logs or core dumps referencing DeliverOneGestureEvent() or exevents.c; X server error logs showing segmentation faults or invalid memory access during gesture event processing.
• Process: Abnormal termination of the X server process (Xorg or Xwayland) coinciding with gesture input activity; unexpected child processes spawned from the X server.
• File System: Core dump files (e.g., core, Xorg.core) in the X server working directory following a crash during gesture handling.
• Network/Session: Unusual or repeated X client connections from low-privilege local users followed by window creation/destruction cycles during active gesture sessions.

Update X.Org X Server to version 21.1.25 or later, and XWayland to version 24.1.14 or later, which include the fix in Xi/exevents.c that extends WindowGone() to also clean up gesture sprite traces. The upstream patch is available at the X.Org GitLab repository (commit efcfd8acc754c5ac4b2555ff375dd5101d735b0a). As a workaround where patching is not immediately possible, restrict local user access to the X server and monitor for unexpected X server crashes. Distribution-specific updates are available from Red Hat, SUSE, openSUSE, Amazon Linux, and others (Red Hat Bugzilla, GitHub Advisory, SUSE Advisory).

The vulnerability was part of a broader X.Org security release that patched 12 CVEs simultaneously, attracting coverage from Linux-focused outlets such as Gaming on Linux, Help Net Security, and Linux Compatible, which highlighted the significance of the batch security update (Gaming on Linux, Help Net Security). Security researchers noted that nine of the twelve patched CVEs allowed arbitrary code execution, placing this vulnerability in a broader context of significant X server security concerns. Vendor responses were prompt, with SUSE, Red Hat, Amazon Linux, and openSUSE all issuing distribution updates shortly after the upstream release.