X.Org Server: Heap buffer overflow via integer truncation in XKB
Summary
The X.Org X server and XWayland contain an integer truncation flaw in XkbResizeKeyType() of the X Keyboard Extension that can lead to a heap buffer overflow. An attacker with local access and an authenticated X client can trigger a crash or potentially execute code in the X server. The attack requires no user interaction, but it is not reachable from the network directly.
Affected
- X.Org server (xorg-x11-server) before 21.1.25
- XWayland before 24.1.14
Fixed in
- Upgrade X.Org server to 21.1.25 or later
- Upgrade XWayland to 24.1.14 or later
- Exact fixed package builds vary by distribution; check your vendor's advisory.
Workaround
Unknown. No vendor workaround published. Limit which local accounts can start X sessions or connect to X on shared systems, and disable XWayland where it is not needed.
Exploitation
- No evidence of exploitation in the wild found; not listed in CISA KEV.
- No public exploit code found.
- Reported through the Zero Day Initiative (ZDI-26-763).
- EPSS: 0.2 % (percentile 10).
Our recommendation
- Patch X.Org server and XWayland in the normal update cycle on headless servers, which typically run no X server.
- Patch sooner on multi-user Linux systems, shared hosts and desktops where untrusted local users or software run.
- Check which systems run an X server or XWayland and track your distribution's update for the server package.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Upstream fix commit (GitLab) gitlab.freedesktop.org
- X.Org Security Advisories www.x.org
- Zero Day Initiative advisory ZDI-26-763 www.zerodayinitiative.com
- GamingOnLinux: xorg-server 21.1.25 and XWayland 24.1.14 released www.gamingonlinux.com
- OpenCVE: CVE-2026-93518 app.opencve.io
- Vulners: Red Hat CVE data for CVE-2026-93518 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:53.
Original description (NVD)
An integer truncation issue in XkbResizeKeyType() that could lead to a heap buffer overflow by authenticated X clients in X.org X server before 21.1.25 and XWayland before 24.1.14 could be exploited for crashes or potential code execution in the X server.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.