CVE-2026-93524

A flaw was found in xorg-x11-server. An authenticated local user can trigger an out-of-bounds heap memory read by sending specially crafted X Keyboard Extension (XKB) requests with inconsistent key range parameters. This flaw leads to information disclosure, allowing the user to read sensitive data from the server's heap memory.

This vulnerability is rated as Low severity for Red Hat Enterprise Linux because exploitation is limited to a local authenticated user session and results solely in a bounded information disclosure without compromising system integrity or availability. A local client connected to the X11 server or Xwayland can trigger an out-of-bounds heap read through crafted keyboard mapping requests, leaking internal server process memory back to the client. The issue does not permit remote access, privilege escalation, or service crashes.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.