Description
A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a crash or potentially code in the x server context.
Published: 2026-10-27
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Potential Code Execution
Action: Immediate Patch
AI Analysis

Impact

A double free occurs in XKB SetGeometry of the X.Org X Server before 21.1.25 and in X Wayland before 24.1.14. The flaw can be triggered by attached clients and may lead to a crash or, at the very least, to execution of code in the X server context. The resulting memory corruption can potentially be leveraged by an attacker to compromise the integrity of the display server or to gain elevated privileges within the server process.

Affected Systems

The vulnerability affects X.Org X Server and its XWayland component. All installations of these components that have not applied the official patch are considered vulnerable. The CVE specifies affected ranges: X.Org X Server versions prior to 21.1.25 and XWayland prior to 24.1.14.

Risk and Exploitability

This weakness received a CVSS score of 7.8, indicating high severity. No EPSS score is available, and the vulnerability is not registered in the CISA KEV catalog. The likely attack vector is local: a malicious user with access to the host who can communicate with the X display server would be able to trigger the double free. Because the flaw can lead to privilege escalation or code execution, the risk to affected systems is significant and demands prompt action.

Generated by OpenCVE AI on October 27, 2026 at 21:13 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update to the latest X.Org X Server and XWayland releases that contain the double‑free fix.
  • If an immediate update is not possible, limit the set of users that can connect to the X display server by configuring Xorg to accept connections only from trusted accounts or by using a secure authentication method such as MIT-MAGIC-COOKIE-1 with a strong cookie.
  • As a complementary measure, consider disabling or limiting XKB geometry processing where feasible, or configuring the display server to run as a non‑privileged user to contain potential exploitation.

Generated by OpenCVE AI on October 27, 2026 at 21:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 18:00:00 +0000

Type Values Removed Values Added
Description A flaw was found in the X.Org X Server and XWayland. An error handling issue in the X Keyboard Extension (XKB) geometry processing fails to clear a memory pointer after an allocation failure, leading to a double-free condition during cleanup. A local user can exploit this vulnerability by sending a specially crafted request to the display server. This can cause memory corruption, potentially resulting in a Denial of Service (DoS) or arbitrary code execution with elevated privileges. A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a crash or potentially code in the x server context.
Title xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling X.Org Server XKB SetGeometry TextDoodad Double Free
First Time appeared X.org xorg-x11-server
X.org xwayland
Weaknesses CWE-415
CPEs cpe:2.3:a:x.org:xorg-x11-server:*:*:*:*:*:*:*:*
cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:*
Vendors & Products X.org xorg-x11-server
X.org xwayland
References

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared X.org
X.org xorg-server
Vendors & Products X.org
X.org xorg-server

Thu, 08 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
Description A flaw was found in the X.Org X Server and XWayland. An error handling issue in the X Keyboard Extension (XKB) geometry processing fails to clear a memory pointer after an allocation failure, leading to a double-free condition during cleanup. A local user can exploit this vulnerability by sending a specially crafted request to the display server. This can cause memory corruption, potentially resulting in a Denial of Service (DoS) or arbitrary code execution with elevated privileges.
Title xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling
Weaknesses CWE-1341
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Important

Subscriptions

X.org Xorg-server Xorg-x11-server Xwayland
cve-icon MITRE

Status: PUBLISHED

Assigner: suse

Published:

Updated: 2026-10-27T17:43:18.583Z

Reserved: 2026-09-10T08:35:07.010Z

Link: CVE-2026-88812

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-27T18:17:38.120

Modified: 2026-10-28T14:15:58.863

Link: CVE-2026-88812

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-07T12:00:00Z

Links: CVE-2026-88812 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T21:15:08Z

Weaknesses
  • CWE-1341

    Multiple Releases of Same Resource or Handle

  • CWE-415

    Double Free