CVE-2026-93523: 
TigerVNC Análise e mitigação de vulnerabilidades

CVE-2026-93523 is an out-of-bounds write vulnerability in xorg-x11-server affecting the ProcXIPassiveUngrabDevice() function. A local authenticated client can exploit this flaw by sending a crafted input device ungrab request containing an unvalidated modifier value greater than 255, causing the server to write out-of-bounds on the heap. The vulnerability was discovered by an anonymous researcher working with Trend Micro's Zero Day Initiative (ZDI-CAN-32366) and was reported on October 2, 2026, with public disclosure on October 7, 2026. It is classified as HIGH severity by Red Hat (Red Hat CVE, Red Hat Bugzilla).

The root cause (CWE-787: Out-of-bounds Write) lies in ProcXIPassiveUngrabDevice() passing client-supplied modifier values directly to DeletePassiveGrabFromList() without validation. DeletePassiveGrabFromList() may call DeleteDetailFromMask(), which uses the macro BITCLEAR(mask, modifier). The mask is allocated as 8 Mask words (256 bits), so a modifier value greater than 255 causes BITCLEAR to index mask[modifier>>5] past the allocation boundary, resulting in a controlled single-bit-clear at an attacker-chosen heap offset. The fix applies the same modifier validation used by CheckGrabValues(): rejecting modifiers that are not XIAnyModifier and have bits set outside AllModifiersMask (Red Hat Bugzilla).

Successful exploitation allows a local authenticated user to corrupt heap memory in the X server process, potentially leading to a denial of service (X server crash) or arbitrary code execution with X server privileges. Because the attacker controls the heap offset of the single-bit-clear, the primitive could be leveraged for more sophisticated memory corruption attacks. The impact is limited to systems running xorg-x11-server where local users have access to the X display (Red Hat CVE, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires local authenticated access to the X server, limiting the attack surface compared to remote vulnerabilities. It was reported through the Trend Micro Zero Day Initiative (ZDI-CAN-32366) and is not listed in the CISA Known Exploited Vulnerabilities catalog. Detection coverage is available via multiple Nessus and Qualys scanner plugins (Red Hat Bugzilla, Red Hat CVE).

1. Gain local access: Obtain a local authenticated session on a system running a vulnerable version of xorg-x11-server with access to the X display (e.g., via DISPLAY=:0).
2. Craft malicious XI request: Using the XInput2 extension API, construct a XIPassiveUngrabDevice request with a modifier value greater than 255 (e.g., 256 or higher), which bypasses the missing validation in ProcXIPassiveUngrabDevice().
3. Trigger out-of-bounds write: Send the crafted request to the X server. The server passes the unvalidated modifier to DeleteDetailFromMask(), which executes BITCLEAR(mask, modifier), writing a cleared bit at mask[modifier>>5] — past the 8-word (256-bit) allocation boundary on the heap.
4. Achieve impact: Depending on heap layout, the controlled single-bit-clear at an attacker-chosen offset can crash the X server (DoS) or, with heap grooming, potentially corrupt adjacent heap metadata or objects to achieve code execution with X server privileges (Red Hat Bugzilla).

• Logs: X server error logs (/var/log/Xorg.0.log) showing segmentation faults, heap corruption errors, or unexpected termination of the X server process.
• Process: Unexpected crashes or restarts of the Xorg process; unusual child processes spawned by the X server.
• Network/Local: Repeated XIPassiveUngrabDevice requests from a local client with anomalous modifier values observable via X protocol debugging tools (e.g., xtrace).
• File System: Core dump files (e.g., core or files in /var/crash/) associated with the Xorg process following unexpected termination.

Red Hat has issued patches for affected RHEL versions: RHSA-2026:82015 (RHEL 9), RHSA-2026:85191 (RHEL 10), RHSA-2026:85193 (RHEL 9), and RHSA-2026:86907 (RHEL 8). Upstream fixes are also available in xorg-server 21.1.25 and Xwayland 24.1.14. As a workaround, restrict local access to the X server and limit which authenticated clients can make XInput2 device requests; consider running the X server with minimal privileges where possible (Red Hat Bugzilla, Gaming on Linux).

The vulnerability was part of a broader batch of security fixes in xorg-server 21.1.25 and Xwayland 24.1.14, which addressed multiple security issues simultaneously, drawing coverage from Linux-focused outlets. SUSE issued multiple security updates (SUSE-SU-2026:4636-1, SUSE-SU-2026:4645-1, SUSE-SU-2026:4663-1, SUSE-SU-2026:4835-1) and OpenBSD published an errata. The oss-security mailing list also carried disclosure details (Gaming on Linux, oss-sec).