Description
A buffer overflow in RandR
ChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14 could be used by authenticated X clients to crash or execute code within the X server context.
Published: 2026-10-28
Score: 7.8 High
EPSS: n/a
KEV: No
Impact: Privilege Escalation
Action: Patch Now
AI Analysis

Impact

A flaw in the X.Org X11 Server causes incorrect calculation of buffer sizes and memory offsets when updating RandR provider properties. The miscalculation leads to a memory corruption when a locally privileged user sends specially crafted property update requests. This can be exploited to elevate privileges or crash the X server, resulting in denial of service.

Affected Systems

The vulnerability affects installations of the X.Org X11 Server; no specific version information is provided by the CNA.

Risk and Exploitability

The CVSS score is 7.8, indicating a high severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, but local attackers with access to the X server can potentially exploit the buffer overflow. The risk is significant for systems that expose the X server to untrusted users or lack proper privilege separation.

Generated by OpenCVE AI on October 8, 2026 at 13:50 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Install the latest patched version of the X.Org X11 Server that addresses the RandR buffer overflow.
  • Disable the RandR extension or restrict its usage to trusted users if a patch is not yet available.
  • Restrict X server access to a limited set of trusted users and implement kernel mitigations such as ASLR and stack canaries.

Generated by OpenCVE AI on October 8, 2026 at 13:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
Description A flaw was found in xorg-x11-server. The X server incorrectly calculates buffer sizes and memory offsets when prepending or appending data to RandR (Resize and Rotate extension) provider properties. A local attacker can exploit this vulnerability by sending specially crafted property update requests, causing memory corruption. This flaw could allow an attacker to escalate privileges or cause a denial of service (DoS) by crashing the X server. A buffer overflow in RandR ChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14 could be used by authenticated X clients to crash or execute code within the X server context.
Title xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests X.Org Server RandR ChangeProviderProperty Heap Buffer Overflow
First Time appeared X.org
X.org xorg-x11-server
X.org xwayland
Weaknesses CWE-122
CPEs cpe:2.3:a:x.org:xorg-x11-server:*:*:*:*:*:*:*:*
cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:*
Vendors & Products X.org
X.org xorg-x11-server
X.org xwayland
References

Thu, 08 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
Description A flaw was found in xorg-x11-server. The X server incorrectly calculates buffer sizes and memory offsets when prepending or appending data to RandR (Resize and Rotate extension) provider properties. A local attacker can exploit this vulnerability by sending specially crafted property update requests, causing memory corruption. This flaw could allow an attacker to escalate privileges or cause a denial of service (DoS) by crashing the X server.
Title xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests
Weaknesses CWE-787
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Important

Subscriptions

X.org Xorg-x11-server Xwayland
cve-icon MITRE

Status: PUBLISHED

Assigner: suse

Published:

Updated: 2026-10-28T15:37:43.432Z

Reserved: 2026-09-18T08:46:56.692Z

Link: CVE-2026-93521

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-28T16:17:10.060

Modified: 2026-10-28T16:17:10.060

Link: CVE-2026-93521

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-07T12:00:00Z

Links: CVE-2026-93521 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-08T14:00:05Z

Weaknesses