CVE-2026-93520

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-93520", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "state": "PUBLISHED", "assignerShortName": "suse", "dateReserved": "2026-09-18T08:46:56.692Z", "datePublished": "2026-10-28T14:59:50.140Z", "dateUpdated": "2026-11-07T04:55:53.988Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2026-10-28T14:59:50.140Z"}, "title": "X.Org Server XKB ChangeKeycodeRange Heap Out-of-Bounds Write", "datePublic": "2026-10-28T14:45:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-122", "description": "CWE-122 Heap-based buffer overflow", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-242", "descriptions": [{"lang": "en", "value": "CAPEC-242 Code Injection"}]}], "affected": [{"vendor": "x.org", "product": "xorg-x11-server", "packageName": "xorg-x11-server", "repo": "https://gitlab.freedesktop.org/xorg/xserver", "versions": [{"status": "affected", "version": "0", "lessThan": "21.1.25", "versionType": "rpm"}], "defaultStatus": "unaffected"}, {"vendor": "x.org", "product": "xwayland", "packageName": "xwayland", "repo": "https://gitlab.freedesktop.org/xorg/xserver", "versions": [{"status": "affected", "version": "0", "lessThan": "24.1.14", "versionType": "rpm"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:x.org:xorg-x11-server:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndExcluding": "21.1.25"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndExcluding": "24.1.14"}]}]}], "descriptions": [{"lang": "en", "value": "A heap buffer overflow caused by mismatching size calculations between\u00a0XkbAllocNames and ChangeKeycodeRange in X.org X server before 2.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A heap buffer overflow caused by mismatching size calculations between&nbsp;<span>XkbAllocNames and </span><span>ChangeKeycodeRange in X.org X server before 2.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.</span>"}]}], "references": [{"url": "https://gitlab.freedesktop.org/xorg/xserver/-/commit/b941a473e06f26a407a9adb15759be79f7418e86", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "credits": [{"lang": "en", "value": "Anonymous working with TrendAI Zero Day Initiative", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-06T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-93520"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-07T04:55:53.988Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-93520", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-06T18:20:53.127160Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T18:33:34.125Z"}}], "cna": {"title": "X.Org Server XKB ChangeKeycodeRange Heap Out-of-Bounds Write", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Anonymous working with TrendAI Zero Day Initiative"}], "impacts": [{"capecId": "CAPEC-242", "descriptions": [{"lang": "en", "value": "CAPEC-242 Code Injection"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://gitlab.freedesktop.org/xorg/xserver", "vendor": "x.org", "product": "xorg-x11-server", "versions": [{"status": "affected", "version": "0", "lessThan": "21.1.25", "versionType": "rpm"}], "packageName": "xorg-x11-server", "defaultStatus": "unaffected"}, {"repo": "https://gitlab.freedesktop.org/xorg/xserver", "vendor": "x.org", "product": "xwayland", "versions": [{"status": "affected", "version": "0", "lessThan": "24.1.14", "versionType": "rpm"}], "packageName": "xwayland", "defaultStatus": "unaffected"}], "datePublic": "2026-10-28T14:45:00.000Z", "references": [{"url": "https://gitlab.freedesktop.org/xorg/xserver/-/commit/b941a473e06f26a407a9adb15759be79f7418e86", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "A heap buffer overflow caused by mismatching size calculations between\u00a0XkbAllocNames and ChangeKeycodeRange in X.org X server before 2.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.", "supportingMedia": [{"type": "text/html", "value": "A heap buffer overflow caused by mismatching size calculations between&nbsp;<span>XkbAllocNames and </span><span>ChangeKeycodeRange in X.org X server before 2.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.</span>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122 Heap-based buffer overflow"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:x.org:xorg-x11-server:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "21.1.25", "versionStartIncluding": "0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "24.1.14", "versionStartIncluding": "0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2026-10-28T14:59:50.140Z"}}}, "cveMetadata": {"cveId": "CVE-2026-93520", "state": "PUBLISHED", "dateUpdated": "2026-11-07T04:55:53.988Z", "dateReserved": "2026-09-18T08:46:56.692Z", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "datePublished": "2026-10-28T14:59:50.140Z", "assignerShortName": "suse"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "xorg-x11-server", "product": "xorg-x11-server", "repo": "https://gitlab.freedesktop.org/xorg/xserver", "vendor": "x.org", "versions": [{"lessThan": "21.1.25", "status": "affected", "version": "0", "versionType": "rpm"}]}, {"defaultStatus": "unaffected", "packageName": "xwayland", "product": "xwayland", "repo": "https://gitlab.freedesktop.org/xorg/xserver", "vendor": "x.org", "versions": [{"lessThan": "24.1.14", "status": "affected", "version": "0", "versionType": "rpm"}]}], "source": "meissner@suse.de"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A heap buffer overflow caused by mismatching size calculations between\u00a0XkbAllocNames and ChangeKeycodeRange in X.org X server before 2.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context."}], "id": "CVE-2026-93520", "lastModified": "2026-11-07T05:19:02.510", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "meissner@suse.de", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-93520", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-10-28T15:17:10.667", "references": [{"source": "meissner@suse.de", "url": "https://gitlab.freedesktop.org/xorg/xserver/-/commit/b941a473e06f26a407a9adb15759be79f7418e86"}], "sourceIdentifier": "meissner@suse.de", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}], "source": "meissner@suse.de", "type": "Secondary"}]}

{"bugzilla": {"description": "xorg-x11-server: XKB ChangeKeycodeRange Heap Out-of-Bounds Write", "id": "2545908", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545908"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["A flaw was found in xorg-x11-server. In the X Keyboard Extension (XKB), key name memory is allocated with an insufficient buffer size compared to the maximum supported range. An authenticated local client can exploit this flaw by sending requests that modify the keycode range, triggering a heap-based buffer overflow. This vulnerability can lead to arbitrary code execution or cause a Denial of Service (DoS) by crashing the X server."], "name": "CVE-2026-93520", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "xorg-x11-server-Xwayland", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "xorg-x11-server", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "xorg-x11-server", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "xorg-x11-server", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "xorg-x11-server-Xwayland", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "xorg-x11-server", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "xorg-x11-server-Xwayland", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-10-07T12:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-93520\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-93520"], "statement": "This vulnerability is rated as having a Moderate severity for Red Hat Enterprise Linux because exploitation requires an established, authenticated connection from a client session to the local display server. Under typical enterprise deployments, Xorg and Xwayland do not listen for unauthenticated network traffic by default, restricting potential attacks to authenticated local users or forwarded sessions. Although a successful exploit may cause memory corruption leading to server crashes or arbitrary code execution within the privileges of the running display server, it cannot be triggered remotely by unauthenticated attackers.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "product": "xorg-server", "vendor": "x.org"}], "created": "2026-10-08T14:00:05.975997+00:00", "updated": "2026-10-28T16:45:04.963473+00:00", "vendors": ["x.org", "x.org$PRODUCT$xorg-server"]}