DEBIAN-CVE-2026-93523: Buffer Overflow

Q: Who can exploit this issue?

An authenticated X client can send the malformed XIPassiveUngrabDevice request. The attack vector is local and requires low privileges; no user interaction is required.

Q: Which deployments are affected?

Deployments using X.Org X Server before 21.1.15 or XWayland before 24.1.14 are affected. The provided data does not identify any configuration prerequisite beyond accepting requests from an authenticated X client.

Q: What is the likely impact of successful exploitation?

A successful exploit can crash the X server and may potentially allow code execution in the X server context. This can affect confidentiality, integrity, and availability.

Published Oct 28, 2026

Updated

A heap buffer overflow caused by a XIPassiveUngrabDevice request with an out-of-range modifier value in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.

Affected Software

6 affected componentsFixes available

debian/xorg-server*

debian/xorg-server<2:21.1.25-1

2:21.1.25-1

debian/xwayland*

debian/xwayland<2:24.1.14-1

2:24.1.14-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/xorg-server to a version that resolves this vulnerability.
Fixed in 2:21.1.25-1
Upgrade
Upgrade debian/xwayland to a version that resolves this vulnerability.
Fixed in 2:24.1.14-1

Event History

Oct 28, 2026

CVE Published

via OSV·05:18 PM

Data Sourced

via OSV·05:18 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can exploit this issue?

An authenticated X client can send the malformed XIPassiveUngrabDevice request. The attack vector is local and requires low privileges; no user interaction is required.

Which deployments are affected?

Deployments using X.Org X Server before 21.1.15 or XWayland before 24.1.14 are affected. The provided data does not identify any configuration prerequisite beyond accepting requests from an authenticated X client.

What is the likely impact of successful exploitation?

A successful exploit can crash the X server and may potentially allow code execution in the X server context. This can affect confidentiality, integrity, and availability.

DEBIAN-CVE-2026-93523: Buffer Overflow

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Which deployments are affected?

What is the likely impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which deployments are affected?

What is the likely impact of successful exploitation?