CVE-2026-93517

A flaw was found in xorg-x11-server. The GLX (OpenGL Extension to the X Window System) interface fails to verify that incoming data sizes do not exceed allocated buffer limits when handling large rendering requests. An authenticated local client can exploit this vulnerability by sending a specially crafted request, triggering a heap-based buffer overflow. Successful exploitation can result in arbitrary code execution with the privileges of the X server or cause a Denial of Service (DoS) by crashing the application.

This vulnerability is rated as Moderate impact by Red Hat Product Security because exploitation is restricted to authenticated local users who have an active session connected to an X11 or Xwayland display server. Default headless and server installations of Red Hat Enterprise Linux do not run a graphical server and are inherently unexposed to this flaw. In workstation and desktop environments, the risk is bounded by the requirement of existing local client access, preventing remote or unauthenticated exploitation without prior compromise.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.