CVE-2026-93521

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-93521", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "state": "PUBLISHED", "assignerShortName": "suse", "dateReserved": "2026-09-18T08:46:56.692Z", "datePublished": "2026-10-28T15:37:43.432Z", "dateUpdated": "2026-11-09T17:00:49.964Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2026-10-28T15:37:43.432Z"}, "title": "X.Org Server RandR ChangeProviderProperty Heap Buffer Overflow", "datePublic": "2026-10-28T15:11:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-122", "description": "CWE-122 Heap-based buffer overflow", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-242", "descriptions": [{"lang": "en", "value": "CAPEC-242 Code Injection"}]}], "affected": [{"vendor": "x.org", "product": "xorg-x11-server", "packageName": "xorg-x11-server", "repo": "https://gitlab.freedesktop.org/xorg/xserver", "versions": [{"status": "affected", "version": "0", "lessThan": "21.1.25", "versionType": "rpm"}], "defaultStatus": "unaffected"}, {"vendor": "x.org", "product": "xwayland", "packageName": "xwayland", "repo": "https://gitlab.freedesktop.org/xorg/xserver", "versions": [{"status": "affected", "version": "0", "lessThan": "24.1.14", "versionType": "rpm"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:x.org:xorg-x11-server:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndExcluding": "21.1.25"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndExcluding": "24.1.14"}]}]}], "descriptions": [{"lang": "en", "value": "A buffer overflow in RandR\nChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14 could be used by authenticated X clients to crash or execute code within the X server context.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>A buffer overflow in RandR\nChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14 could be used by authenticated X clients to crash or execute code within the X server context.</p><br>"}]}], "references": [{"url": "https://gitlab.freedesktop.org/xorg/xserver/-/commit/5dc9efd5a199717b53f70b9c6cd336a522370e46", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "credits": [{"lang": "en", "value": "Anonymous working with TrendAI Zero Day Initiative", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-09T16:11:36.357536Z", "id": "CVE-2026-93521", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T17:00:49.964Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-93521", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-09T16:11:36.357536Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T16:11:37.505Z"}}], "cna": {"title": "X.Org Server RandR ChangeProviderProperty Heap Buffer Overflow", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Anonymous working with TrendAI Zero Day Initiative"}], "impacts": [{"capecId": "CAPEC-242", "descriptions": [{"lang": "en", "value": "CAPEC-242 Code Injection"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://gitlab.freedesktop.org/xorg/xserver", "vendor": "x.org", "product": "xorg-x11-server", "versions": [{"status": "affected", "version": "0", "lessThan": "21.1.25", "versionType": "rpm"}], "packageName": "xorg-x11-server", "defaultStatus": "unaffected"}, {"repo": "https://gitlab.freedesktop.org/xorg/xserver", "vendor": "x.org", "product": "xwayland", "versions": [{"status": "affected", "version": "0", "lessThan": "24.1.14", "versionType": "rpm"}], "packageName": "xwayland", "defaultStatus": "unaffected"}], "datePublic": "2026-10-28T15:11:00.000Z", "references": [{"url": "https://gitlab.freedesktop.org/xorg/xserver/-/commit/5dc9efd5a199717b53f70b9c6cd336a522370e46", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "A buffer overflow in RandR\nChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14 could be used by authenticated X clients to crash or execute code within the X server context.", "supportingMedia": [{"type": "text/html", "value": "<p>A buffer overflow in RandR\nChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14 could be used by authenticated X clients to crash or execute code within the X server context.</p><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122 Heap-based buffer overflow"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:x.org:xorg-x11-server:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "21.1.25", "versionStartIncluding": "0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "24.1.14", "versionStartIncluding": "0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2026-10-28T15:37:43.432Z"}}}, "cveMetadata": {"cveId": "CVE-2026-93521", "state": "PUBLISHED", "dateUpdated": "2026-11-09T17:00:49.964Z", "dateReserved": "2026-09-18T08:46:56.692Z", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "datePublished": "2026-10-28T15:37:43.432Z", "assignerShortName": "suse"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "xorg-x11-server", "product": "xorg-x11-server", "repo": "https://gitlab.freedesktop.org/xorg/xserver", "vendor": "x.org", "versions": [{"lessThan": "21.1.25", "status": "affected", "version": "0", "versionType": "rpm"}]}, {"defaultStatus": "unaffected", "packageName": "xwayland", "product": "xwayland", "repo": "https://gitlab.freedesktop.org/xorg/xserver", "vendor": "x.org", "versions": [{"lessThan": "24.1.14", "status": "affected", "version": "0", "versionType": "rpm"}]}], "source": "meissner@suse.de"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A buffer overflow in RandR\nChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14 could be used by authenticated X clients to crash or execute code within the X server context."}], "id": "CVE-2026-93521", "lastModified": "2026-11-09T17:17:34.373", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "meissner@suse.de", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-93521", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-09T16:11:36.357536Z", "version": "2.0.3"}}]}, "published": "2026-10-28T16:17:10.060", "references": [{"source": "meissner@suse.de", "url": "https://gitlab.freedesktop.org/xorg/xserver/-/commit/5dc9efd5a199717b53f70b9c6cd336a522370e46"}], "sourceIdentifier": "meissner@suse.de", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}], "source": "meissner@suse.de", "type": "Secondary"}]}

{"bugzilla": {"description": "xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests", "id": "2545164", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545164"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["A flaw was found in xorg-x11-server. The X server incorrectly calculates buffer sizes and memory offsets when prepending or appending data to RandR (Resize and Rotate extension) provider properties. A local attacker can exploit this vulnerability by sending specially crafted property update requests, causing memory corruption. This flaw could allow an attacker to escalate privileges or cause a denial of service (DoS) by crashing the X server."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-93521", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "xorg-x11-server-Xwayland", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Under investigation", "package_name": "xorg-x11-server", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "xorg-x11-server", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "xorg-x11-server", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "xorg-x11-server-Xwayland", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "xorg-x11-server", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "xorg-x11-server-Xwayland", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-10-07T12:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-93521\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-93521"], "statement": "This vulnerability is rated as an Important severity flaw because an authenticated local client can trigger memory corruption within the X server to crash the display server or potentially execute arbitrary code with elevated privileges. In Red Hat Enterprise Linux environments, modern desktop sessions default to Wayland, which restricts direct exposure to Xwayland compatibility instances. However, systems actively utilizing traditional Xorg sessions remain exposed to local privilege escalation by any authorized user with access to the X display.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 90.0, "source": "matching"}]}, "product": "x_server", "vendor": "x.org"}], "created": "2026-10-08T14:00:05.975755+00:00", "updated": "2026-11-10T08:30:23.037692+00:00", "vendors": ["x.org", "x.org$PRODUCT$x_server"]}