CVE-2026-93536: 
TigerVNC vulnerability analysis and mitigation

CVE-2026-93536 is a use-after-free vulnerability in the X.Org Server's gesture event handling subsystem, specifically in the GestureBuildSprite() and WindowGone() functions. When a window is destroyed during an active gesture, the server fails to clean up stale WindowPtr references in gesture sprite traces, allowing DeliverOneGestureEvent() to later dereference freed memory. The flaw affects xorg-server versions prior to 21.1.25 and xwayland versions prior to 24.1.14. It carries a CVSS v3.1 base score of 5.3 (Medium), though Feedly categorizes it as HIGH severity (Red Hat CVE, Red Hat Bugzilla).

The root cause (CWE-825: Expired Pointer Dereference / CWE-416: Use After Free) lies in GestureBuildSprite(), which copies raw WindowPtr values into gesture sprite traces via CopySprite() without reference counting or lifetime management. The WindowGone() function only cleaned up touch sprite traces, not gesture sprite traces, leaving dangling WindowPtr references when a window is destroyed mid-gesture. When DeliverOneGestureEvent() subsequently calls DeepestSpriteWin(&gi->sprite)->drawable.id, it dereferences the stale pointer, reading 4 bytes from freed memory. The fix, authored by Peter Hutterer, modifies WindowGone() to also iterate over gesture sprite traces and truncate them when the destroyed window is found. The vulnerability was discovered by researcher 4nibhal working with TrendAI Zero Day Initiative (ZDI-CAN-32753) (Red Hat Bugzilla).

A local attacker with low privileges can trigger this use-after-free without user interaction to read 4 bytes of freed heap memory (drawable.id), potentially leaking sensitive information about heap contents. Additionally, the invalid memory dereference can crash the X.Org Server, resulting in a denial of service for all users of the display session. The scope is limited to the local system; there is no known path to remote exploitation or privilege escalation beyond information disclosure (Red Hat CVE, Red Hat Bugzilla).

No public proof-of-concept exploit code has been published, and there is no evidence of in-the-wild exploitation as of the time of reporting (Red Hat CVE). The vulnerability requires local access and low privileges, and exploitation involves a race condition between window destruction and an active gesture event, adding complexity. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection coverage exists via multiple Nessus and Qualys scanner plugins (Feedly).

1. Gain local access: Obtain a low-privilege local account on a system running a vulnerable X.Org Server (prior to 21.1.25) or Xwayland (prior to 24.1.14) with gesture input support enabled.
2. Initiate a gesture event: Use an input device or synthesize gesture events (e.g., multi-touch pinch/swipe) to begin an active gesture sequence, causing the server to populate gesture sprite traces with WindowPtr references via GestureBuildSprite().
3. Destroy the tracked window: While the gesture is in progress, destroy or unmap the window that is referenced in the gesture sprite trace (e.g., by closing the application window or unmapping it via X11 API calls).
4. Trigger the use-after-free: Continue or complete the gesture event, causing DeliverOneGestureEvent() to call DeepestSpriteWin(&gi->sprite)->drawable.id on the now-freed WindowPtr, reading 4 bytes of freed heap memory.
5. Observe the result: The freed memory contents (drawable.id) are read and may be observable through X server behavior or crash artifacts, potentially leaking heap layout information or causing a server crash (DoS) (Red Hat Bugzilla).

• Logs: Unexpected X.Org Server crash logs or core dumps in /var/log/Xorg.0.log or systemd journal entries referencing segmentation faults or invalid memory access in DeliverOneGestureEvent or WindowGone.
• Process: Abnormal termination of the Xorg or Xwayland process, particularly following multi-touch or gesture input activity.
• File System: Presence of core dump files (e.g., core, Xorg.core) in the X server working directory or /var/crash/ following gesture-related crashes.
• Network: No network-based IOCs are expected given the local-only attack vector.

Upgrade to xorg-server 21.1.25 or xwayland 24.1.14, which contain the patch that adds gesture sprite trace cleanup to WindowGone(). Distribution-specific updates are available from Red Hat, SUSE (SUSE-SU-2026:4645-1, SUSE-SU-2026:4835-1), openSUSE, FreeBSD, and OpenBSD (SUSE Advisory, OpenBSD Errata). As a workaround where patching is not immediately possible, restrict local user access to the X server and disable gesture input device support if not required. Monitor for unexpected X server crashes as a detection measure.

The vulnerability was publicly disclosed on October 7, 2026, as part of a broader X.Org Server security update addressing 12 CVEs, which received coverage from HelpNet Security, Gaming on Linux, and Linux security news outlets (HelpNet Security, Gaming on Linux). Security researcher 4nibhal was credited with discovery through the TrendAI Zero Day Initiative (ZDI-CAN-32753), with AI assistance noted in the patch commit (Red Hat Bugzilla). Community reaction was moderate, with the batch release of 12 CVEs drawing more attention than this individual flaw given its medium severity and local-only attack vector.