CVE-2026-93518: X.Org Server XKB ResizeKeyType Numeric Truncation
Published Oct 28, 2026
·Updated
An integer truncation issue in XkbResizeKeyType() that could lead to a heap buffer overflow by authenticated X clients in X.org X server before 21.1.25 and XWayland before 24.1.14 could be exploited for crashes or potential code execution in the X server.
Affected Software
2 affected components
X.Org X.Org X Server<21.1.25
X.Org Xwayland<24.1.14
Event History
Oct 28, 2026
CVE Published
via MITRE·02:32 PM
Data Sourced
via MITRE·02:32 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which versions are affected?
X.Org X server versions before 21.1.25 and XWayland versions before 24.1.14 are affected.
2
What access does an attacker need?
Exploitation requires an authenticated X client. The vulnerability is rated with local attack vector and low privileges required, with no user interaction required.
3
What could successful exploitation do?
The heap buffer overflow could crash the X server or potentially allow code execution in the X server.