CVE-2026-93523

A flaw was found in xorg-x11-server. A local authenticated client can exploit this flaw by sending a crafted input device ungrab request with an unvalidated modifier value. This lack of validation causes the server to perform an out-of-bounds write on the heap, resulting in memory corruption that can lead to a denial of service (DoS) or potential arbitrary code execution.

This vulnerability is rated as Important severity because an authenticated local client can trigger heap memory corruption, which may allow local privilege escalation if the display server operates with administrative privileges or cause a denial of service by terminating the session. In standard Red Hat Enterprise Linux deployments using Wayland, the root impact is reduced as XWayland runs within an unprivileged user session; however, legacy Xorg server configurations running as root remain susceptible to full privilege escalation. Headless server installations that do not run graphical display environments are not exposed to this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.