X.Org Server and XWayland: Heap buffer overflow in XIPassiveUngrabDevice

Summary

A heap buffer overflow in the X.Org X Server and XWayland, triggered by an XIPassiveUngrabDevice request with an out-of-range modifier value, can be exploited by an authenticated local X client. Successful exploitation can crash the X server or, potentially, execute code in the X server context. ZDI describes the impact as escalation to root, while Red Hat limits the root impact to legacy X servers running as root. The attacker first needs low-privileged code execution on the target; this is not a remote, internet-facing flaw.

Affected

• X.Org X Server (xorg-server / xorg-x11-server) before 21.1.25 (per SUSE CNA record and vendor-linked sources)
• XWayland before 24.1.14
• Note: the CVE description states 'before 21.1.15', which conflicts with the 21.1.25 release used by other sources.
• Distribution packages: check your vendor's tracker for the exact package version (Red Hat: RHSA-2026:85191).

Fixed in

• X.Org X Server 21.1.25 or later
• XWayland 24.1.14 or later
• Fix commit: 37a1847a60c6799aecf163a5cfa40077a9002675
• Distributions may ship backported fixes with different package versions.

Workaround

• No vendor workaround available; Red Hat states the currently available mitigations do not meet its criteria.
• Remove X server packages on headless servers that do not run graphical environments.
• Do not run the X server as root.

Exploitation

• In the wild: Unknown. Not listed in the CISA KEV catalog.
• Public disclosure: ZDI advisory ZDI-26-768 published on October 15, 2026.
• Proof of concept: No public PoC or exploit found in the research.
• Prerequisite: attacker must already run low-privileged code on the target.

Our recommendation

• Inventory Linux hosts with an X server or XWayland and check whether graphical sessions or X forwarding are in use.
• Update X.Org Server to 21.1.25 or XWayland to 24.1.14, or install your distribution's fixed build.
• Remove X packages on headless servers that do not need them.
• Prioritise multi-user systems, terminal servers, jump hosts and any host where the X server runs as root.
• Install the other X.Org fixes from the same October 2026 release at the same time.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Fix commit (GitLab X.Org) gitlab.freedesktop.org
• Red Hat CVE record access.redhat.com
• Red Hat errata RHSA-2026:85191 access.redhat.com
• Zero Day Initiative ZDI-26-768 www.zerodayinitiative.com
• 9to5Linux release report 9to5linux.com
• GamingOnLinux release report www.gamingonlinux.com
• Help Net Security overview www.helpnetsecurity.com
• OSV Azure Linux AZL-111464 osv.dev

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:44.