ZDI-CAN-32366: ZDI-26-768: X.Org Server XInput ProcXIPassiveUngrabDevice Heap-based Buffer Overflow Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of X.Org Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-93523.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Affected X.Org Server installations are exposed when an attacker can already execute code as a low-privileged local user on the system. The issue is a local privilege-escalation vulnerability, not one described as remotely exploitable.
What access does an attacker need to exploit it?
The attacker must first obtain the ability to run low-privileged code on the target system. The provided information does not identify any additional required configuration or user interaction.
What is the potential impact of successful exploitation?
A successful exploit can allow a local attacker to escalate privileges on an affected system. The vulnerability is identified as a heap-based buffer overflow in XInput ProcXIPassiveUngrabDevice.