CVE-2026-88812

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-88812", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "state": "PUBLISHED", "assignerShortName": "suse", "dateReserved": "2026-09-10T08:35:07.010Z", "datePublished": "2026-10-27T17:43:18.583Z", "dateUpdated": "2026-11-04T20:20:33.730Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2026-10-27T17:43:18.583Z"}, "title": "X.Org Server XKB SetGeometry TextDoodad Double Free", "datePublic": "2026-10-27T16:47:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-415", "description": "CWE-415 Double free", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-175", "descriptions": [{"lang": "en", "value": "CAPEC-175 Code Inclusion"}]}], "affected": [{"vendor": "X.org", "product": "xorg-x11-server", "packageName": "xorg-x11-server", "repo": "https://gitlab.freedesktop.org/xorg/xserver", "versions": [{"status": "affected", "version": "0", "lessThan": "21.1.25", "versionType": "rpm"}], "defaultStatus": "unaffected"}, {"vendor": "x.org", "product": "xwayland", "packageName": "xwayland", "repo": "https://gitlab.freedesktop.org/xorg/xserver", "versions": [{"status": "affected", "version": "0", "lessThan": "24.1.14", "versionType": "rpm"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:x.org:xorg-x11-server:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndExcluding": "21.1.25"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndExcluding": "24.1.14"}]}]}], "descriptions": [{"lang": "en", "value": "A double free in\u00a0XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a crash or potentially code in the x server context.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a crash or potentially code in the x server context."}]}], "references": [{"url": "https://gitlab.freedesktop.org/xorg/xserver/-/commit/0d1b1b0bad86c9ea2a3b7ca5a70e681dc69f1ecc", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "credits": [{"lang": "en", "value": "Anonymous with TrendAI Zero Day Initiative", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-04T20:06:20.465140Z", "id": "CVE-2026-88812", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-04T20:20:33.730Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-88812", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-04T20:06:20.465140Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-04T20:06:21.224Z"}}], "cna": {"title": "X.Org Server XKB SetGeometry TextDoodad Double Free", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Anonymous with TrendAI Zero Day Initiative"}], "impacts": [{"capecId": "CAPEC-175", "descriptions": [{"lang": "en", "value": "CAPEC-175 Code Inclusion"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://gitlab.freedesktop.org/xorg/xserver", "vendor": "X.org", "product": "xorg-x11-server", "versions": [{"status": "affected", "version": "0", "lessThan": "21.1.25", "versionType": "rpm"}], "packageName": "xorg-x11-server", "defaultStatus": "unaffected"}, {"repo": "https://gitlab.freedesktop.org/xorg/xserver", "vendor": "x.org", "product": "xwayland", "versions": [{"status": "affected", "version": "0", "lessThan": "24.1.14", "versionType": "rpm"}], "packageName": "xwayland", "defaultStatus": "unaffected"}], "datePublic": "2026-10-27T16:47:00.000Z", "references": [{"url": "https://gitlab.freedesktop.org/xorg/xserver/-/commit/0d1b1b0bad86c9ea2a3b7ca5a70e681dc69f1ecc", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "A double free in\u00a0XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a crash or potentially code in the x server context.", "supportingMedia": [{"type": "text/html", "value": "A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a crash or potentially code in the x server context.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-415", "description": "CWE-415 Double free"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:x.org:xorg-x11-server:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "21.1.25", "versionStartIncluding": "0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "24.1.14", "versionStartIncluding": "0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2026-10-27T17:43:18.583Z"}}}, "cveMetadata": {"cveId": "CVE-2026-88812", "state": "PUBLISHED", "dateUpdated": "2026-11-04T20:20:33.730Z", "dateReserved": "2026-09-10T08:35:07.010Z", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "datePublished": "2026-10-27T17:43:18.583Z", "assignerShortName": "suse"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "xorg-x11-server", "product": "xorg-x11-server", "repo": "https://gitlab.freedesktop.org/xorg/xserver", "vendor": "X.org", "versions": [{"lessThan": "21.1.25", "status": "affected", "version": "0", "versionType": "rpm"}]}, {"defaultStatus": "unaffected", "packageName": "xwayland", "product": "xwayland", "repo": "https://gitlab.freedesktop.org/xorg/xserver", "vendor": "x.org", "versions": [{"lessThan": "24.1.14", "status": "affected", "version": "0", "versionType": "rpm"}]}], "source": "meissner@suse.de"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A double free in\u00a0XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a crash or potentially code in the x server context."}], "id": "CVE-2026-88812", "lastModified": "2026-11-04T21:18:15.380", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "meissner@suse.de", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-88812", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-04T20:06:20.465140Z", "version": "2.0.3"}}]}, "published": "2026-10-27T18:17:38.120", "references": [{"source": "meissner@suse.de", "url": "https://gitlab.freedesktop.org/xorg/xserver/-/commit/0d1b1b0bad86c9ea2a3b7ca5a70e681dc69f1ecc"}], "sourceIdentifier": "meissner@suse.de", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-415"}], "source": "meissner@suse.de", "type": "Secondary"}]}

{"bugzilla": {"description": "xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling", "id": "2545174", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545174"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-1341", "details": ["A flaw was found in the X.Org X Server and XWayland. An error handling issue in the X Keyboard Extension (XKB) geometry processing fails to clear a memory pointer after an allocation failure, leading to a double-free condition during cleanup. A local user can exploit this vulnerability by sending a specially crafted request to the display server. This can cause memory corruption, potentially resulting in a Denial of Service (DoS) or arbitrary code execution with elevated privileges."], "mitigation": {"lang": "en:us", "value": "On server systems where a graphical desktop interface is not required, exposure can be mitigated by disabling the graphical display manager or removing optional X11/Xwayland packages.\nTo disable the graphical interface and boot into text mode:\n```\nsystemctl set-default multi-user.target\nsystemctl isolate multi-user.target\n```\nAlternatively, remove the affected packages if graphical sessions are not utilized:\n```\ndnf remove xorg-x11-server-Xorg xorg-x11-server-Xwayland\n```\nCaveats:\nRemoving these packages or switching system targets will disable graphical login, may remove GNOME and related desktop packages via package manager dependencies, and will break graphical desktop functionality. The server will remain fully accessible and usable via local console terminals and remote SSH sessions.\nWarning: Executing these commands will immediately terminate all active graphical sessions."}, "name": "CVE-2026-88812", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "xorg-x11-server-Xwayland", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Under investigation", "package_name": "xorg-x11-server", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "xorg-x11-server", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "xorg-x11-server", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "xorg-x11-server-Xwayland", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "xorg-x11-server", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "xorg-x11-server-Xwayland", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-10-07T12:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-88812\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-88812"], "statement": "This vulnerability is rated as Important because an authenticated local user able to connect to the X server or Xwayland display can trigger memory corruption, potentially leading to arbitrary code execution or privilege escalation with the privileges of the running display server. In typical Red Hat Enterprise Linux workstation and desktop environments, the X server or Xwayland runs as part of the user session, limiting the blast radius, though legacy configurations or privileged Xorg deployments could allow full local privilege escalation. Environments running headless servers without active graphical sessions or X11 forwarding are not exposed to this issue.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 75.0, "confidence_source": "inferred", "scores": [{"score": 75.0, "source": "inferred"}, {"score": 86.0, "source": "matching"}]}, "product": "xorg-server", "vendor": "x.org"}], "created": "2026-10-08T14:00:05.976595+00:00", "updated": "2026-10-27T21:15:08.700884+00:00", "vendors": ["x.org", "x.org$PRODUCT$xorg-server"]}