CVE-2026-93524: 
TigerVNC vulnerability analysis and mitigation

CVE-2026-93524 is an out-of-bounds heap memory read vulnerability in xorg-x11-server, specifically within the X Keyboard Extension (XKB) SetMap handler. An authenticated local user can trigger the flaw by sending specially crafted XKB requests with inconsistent key range parameters, causing the server to disclose heap memory contents to the requesting client. The vulnerability was reported on October 5, 2026, publicly disclosed on October 7, 2026, and fixed in xorg-server 21.1.25 and xwayland 24.1.14. It carries a CVSS v3.1 base score of 3.3 (Low) (Red Hat CVE, Red Hat Bugzilla).

The root cause (CWE-125: Out-of-bounds Read) lies in an indexing inconsistency within CheckKeySyms() in xkb/xkb.c. The function uses two loops: the first processes keys in the SetMap request range using a zero-based index offset by req->firstKeySym, but the second loop — intended to fill in keys from the existing map — incorrectly restarts at the raw counter value i = nKeySyms rather than i = firstKeySym + nKeySyms. When firstKeySym is large and nKeySyms is small, the second loop overwrites the newly computed symsPerKey[] widths with stale values from the existing keymap. CheckKeyActions() then validates the wire action count against the stale width and accepts it; SetKeySyms() widens the key (resizing actions to nGroups * newWidth), but SetKeyActions() resizes again to the old (smaller) count. A subsequent XkbGetMap request reads XkbKeyNumActions() entries — derived from the new, wider key_sym_map.width — from the shorter action allocation, producing an out-of-bounds heap read whose bytes are copied into the GetMap reply and returned to the client. The vulnerability was discovered by WONJOON HWANG (@joon1337) working with TrendAI Zero Day Initiative (ZDI-CAN-32408) (Red Hat Bugzilla).

Successful exploitation results in a bounded heap information disclosure: overread bytes from the X server's heap memory are copied into the XkbGetMap reply and sent back to the authenticated local client. This could expose sensitive data resident in heap memory, such as cryptographic material, credentials, or other process data. There is no integrity or availability impact, and exploitation is limited to local authenticated users with access to the X server socket (Red Hat CVE, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The vulnerability requires local authenticated access to the X server, significantly limiting the attack surface. The CVE status remains "Reserved" and it has not been added to the CISA Known Exploited Vulnerabilities catalog. No EPSS score data is available from the provided sources (Red Hat CVE).

1. Gain local access: Obtain an authenticated local session on a system running a vulnerable version of xorg-x11-server (prior to 21.1.25) or xwayland (prior to 24.1.14) with access to the X server socket.
2. Craft a malicious XKB SetMap request: Construct an XkbSetMap request with a large firstKeySym value and a small nKeySyms value, creating an inconsistency that causes CheckKeySyms() to overwrite newly computed symsPerKey[] entries with stale widths from the existing keymap.
3. Trigger the desynchronization: Send the crafted request to the X server. The inconsistent indexing causes CheckKeyActions() to accept an action count validated against the stale (smaller) width, while SetKeySyms() widens the key to the new (larger) width.
4. Issue an XkbGetMap request: Send a follow-up XkbGetMap request for the affected key. The server reads XkbKeyNumActions() entries (based on the new wider width) from the shorter action allocation, performing an out-of-bounds heap read.
5. Receive disclosed heap data: The overread bytes are included in the XkbGetMap reply returned to the client, exposing a bounded region of the X server's heap memory (Red Hat Bugzilla).

The vulnerability is fixed in xorg-server 21.1.25 and xwayland 24.1.14, which correct the loop indexing in CheckKeySyms() by adding i = req->firstKeySym + req->nKeySyms before the second loop. Vendor patches are available from Red Hat (via Bugzilla 2545945) and SUSE (SUSE-SU-2026:4636-1, SUSE-SU-2026:4645-1, SUSE-SU-2026:4663-1, SUSE-SU-2026:4835-1). As a workaround, restrict local access to the X server to trusted users only, and consider disabling or limiting XKB functionality if it is not required in your environment (Red Hat Bugzilla, SUSE Advisory).

The vulnerability was part of a broader batch of 12 CVEs patched in xorg-server 21.1.25 and xwayland 24.1.14, which received coverage from security news outlets including Help Net Security and Gaming on Linux, as well as Linux security aggregators. The broader release was described as addressing nine CVEs allowing arbitrary code execution alongside lower-severity information disclosure flaws. Community reaction was generally focused on the more severe RCE-class vulnerabilities in the same release, with CVE-2026-93524 receiving less individual attention due to its low CVSS score and local-only attack vector (Help Net Security, Gaming on Linux).