CVE-2026-93520: 
TigerVNC vulnerability analysis and mitigation

CVE-2026-93520 is a heap-based buffer overflow vulnerability in the X Keyboard Extension (XKB) of xorg-x11-server, allowing an authenticated local client to execute arbitrary code or crash the X server. The flaw stems from an incomplete fix regression: XkbAllocNames() allocates names->keys using max_key_code+1 while the ChangeKeycodeRange path uses MAP_LENGTH (256), creating an undersized buffer. It was discovered by an anonymous researcher working with TrendAI Zero Day Initiative (ZDI-CAN-31941) and disclosed on October 7, 2026. Fixed versions are xorg-server-21.1.25 and xwayland-24.1.14. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) (Red Hat CVE, Red Hat Bugzilla).

The root cause is an out-of-bounds write (CWE-787) introduced by an incomplete fix in commit a3171732d ("xkb: Always use MAP_LENGTH keymap size"), which converted most XKB allocation functions to use MAP_LENGTH (256) but missed XkbAllocNames(), which still allocates names->keys as calloc(max_key_code + 1, sizeof(XkbKeyNameRec)). When a keymap component with a small max_key_code (e.g., sun(type6) with max_key_code=132) is loaded and a subsequent SetMap request extends maxKeyCode to 255, XkbChangeKeycodeRange() performs a memset on names->keys up to MAP_LENGTH-1, writing past the end of the undersized allocation. An authenticated local X client can trigger this by sending XKB requests that modify the keycode range. The fix is a one-line change in xkb/XKBAlloc.c to allocate names->keys to MAP_LENGTH instead of max_key_code+1 (Red Hat Bugzilla).

Successful exploitation allows an authenticated local user to achieve arbitrary code execution in the context of the X server process, which typically runs with elevated privileges, or to crash the X server causing a denial of service for all graphical sessions on the affected system. The confidentiality, integrity, and availability impacts are all rated High. Because the X server mediates all graphical input and output, compromise could expose sensitive on-screen data, keystrokes, and clipboard contents, and may facilitate privilege escalation depending on the server's runtime permissions (Red Hat CVE, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The vulnerability requires authenticated local access to the X server, limiting the attack surface compared to network-exploitable flaws. The CVE was reported through the TrendAI Zero Day Initiative (ZDI-CAN-31941) by an anonymous researcher. CISA KEV catalog status is not applicable at this time, and no EPSS score data is available from the provided sources (Red Hat Bugzilla, Red Hat CVE).

1. Gain local authenticated access: Obtain a local user account on a system running a vulnerable version of xorg-x11-server (prior to 21.1.25) or Xwayland (prior to 24.1.14) with an active X session.
2. Load a keymap with a small max_key_code: As an authenticated X client, send an XKB request to load a keymap component that sets a small max_key_code value (e.g., the sun(type6) layout with max_key_code=132). This causes XkbAllocNames() to allocate names->keys with only 133 entries.
3. Trigger keycode range extension: Send a subsequent SetMap or equivalent XKB request that extends maxKeyCode to 255, invoking XkbChangeKeycodeRange().
4. Trigger heap out-of-bounds write: The ChangeKeycodeRange path performs a memset on names->keys from the old max_key_code up to MAP_LENGTH-1 (255), writing beyond the allocated buffer boundary into adjacent heap memory.
5. Achieve code execution or DoS: Depending on heap layout, the out-of-bounds write may corrupt adjacent heap metadata or function pointers, enabling arbitrary code execution as the X server process, or may cause an immediate crash resulting in denial of service (Red Hat Bugzilla).

• Logs: X server crash logs or core dumps in /var/log/Xorg.0.log or systemd journal showing segmentation faults or heap corruption errors in XKB-related functions such as XkbAllocNames or XkbChangeKeycodeRange.
• Process: Unexpected termination of the Xorg or Xwayland process; unusual child processes spawned by the X server process.
• Network/Local: Repeated or unusual XKB SetMap or keycode range modification requests from a local X client, observable via X protocol debugging tools such as xscope or xtrace.
• File System: Unexpected core dump files (e.g., core, Xorg.core) in the X server working directory or /tmp.

The vulnerability is fixed in xorg-server 21.1.25 and xwayland 24.1.14; users should upgrade to these versions immediately. Red Hat has issued patches for RHEL 8 (RHSA-2026:86907), RHEL 9 (RHSA-2026:84574, RHSA-2026:85193), and RHEL 10 (RHSA-2026:85191). SUSE has released updates (SUSE-SU-2026:4636-1, SUSE-SU-2026:4645-1, SUSE-SU-2026:4663-1, SUSE-SU-2026:4835-1). As a workaround where patching is not immediately possible, restrict local user access to X server connections and limit which authenticated users can interact with the X Keyboard Extension (Red Hat Bugzilla, Red Hat CVE, SUSE Advisory).

The vulnerability was part of a broader batch of 12 CVEs patched in xorg-server 21.1.25 and xwayland 24.1.14, with security news outlets noting that nine of the twelve allow arbitrary code execution. Help Net Security and Gaming on Linux covered the release, and the broader Linux security community tracked the patch rollout across distributions including SUSE, openSUSE, Red Hat, Oracle Linux, and FreeBSD (Help Net Security, Gaming on Linux, Deaf News).