CVE-2026-93523: X.Org Server XInput2 PassiveUngrabDevice Out-of-Bounds Write
Published Oct 28, 2026
·Updated
A heap buffer overflow caused by a XIPassiveUngrabDevice request with an out-of-range modifier value in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.
Affected Software
2 affected components
X.Org X Server<21.1.15
X.Org Xwayland<24.1.14
Event History
Oct 28, 2026
CVE Published
via MITRE·04:16 PM
Data Sourced
via MITRE·04:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which releases need to be updated?
X.Org X Server releases before 21.1.15 and XWayland releases before 24.1.14 are affected. Upgrade to at least the respective listed version.
2
What level of access does an attacker need?
Exploitation requires an authenticated X client and local access, reflected by the local attack vector and low-privileges-required rating. The flaw may allow the client to crash the server or potentially execute code in the X server context.