{}

{}

{}

{"bugzilla": {"description": "xorg-x11-server: XKB ChangeKeycodeRange Heap Out-of-Bounds Write", "id": "2545908", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545908"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["A flaw was found in xorg-x11-server. In the X Keyboard Extension (XKB), key name memory is allocated with an insufficient buffer size compared to the maximum supported range. An authenticated local client can exploit this flaw by sending requests that modify the keycode range, triggering a heap-based buffer overflow. This vulnerability can lead to arbitrary code execution or cause a Denial of Service (DoS) by crashing the X server."], "name": "CVE-2026-93520", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "xorg-x11-server-Xwayland", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "xorg-x11-server", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "xorg-x11-server", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "xorg-x11-server", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "xorg-x11-server-Xwayland", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "xorg-x11-server", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "xorg-x11-server-Xwayland", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-10-07T12:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-93520\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-93520"], "statement": "This vulnerability is rated as having a Moderate severity for Red Hat Enterprise Linux because exploitation requires an established, authenticated connection from a client session to the local display server. Under typical enterprise deployments, Xorg and Xwayland do not listen for unauthenticated network traffic by default, restricting potential attacks to authenticated local users or forwarded sessions. Although a successful exploit may cause memory corruption leading to server crashes or arbitrary code execution within the privileges of the running display server, it cannot be triggered remotely by unauthenticated attackers.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "product": "xorg-server", "vendor": "x.org"}], "created": "2026-10-08T14:00:05.975997+00:00", "updated": "2026-10-22T21:18:49.610586+00:00", "vendors": ["x.org", "x.org$PRODUCT$xorg-server"]}