Medium severity · published Oct 28, 2026
CVE-2026-93515
.Org Server Present Extension Use-After-Free
New
6.8
CVSS
–
EPSS
No
On KEV
Description
A use-after-free in present_clear_window_notifies() in the X.org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by malicious X clients to crash or potentially execute code in the X server context.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
XO
xorg-x11-server · X.org
before 21.1.25 · source: vendor
XW
xwayland · x.org
before 24.1.14 · source: vendor
In the news
VulnerabilityMedium
ZDI-26-760: X.Org Server Present Extension Use-After-Free Information Disclosure Vulnerability
This vulnerability allows local attackers to disclose sensitive information on affected installations of X.Org Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.5. The following CVEs are assigned: CVE-2026-93515.
Oct 15, 2026·Zero Day Initiative
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-93515
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-93515
gitlab.freedesktop.org
https://gitlab.freedesktop.org/xorg/xserver/-/commit/1b6955c3108e6b43433aefe860070708e6f43d1b
More from xorg-x11-server
7.8
CVE-2026-93523
X.Org Server XInput2 PassiveUngrabDevice Out-of-Bounds Write
7.8
CVE-2026-93522
X.Org Server Glamor CopyArea Heap Buffer Overflow
7.8
CVE-2026-93521
X.Org Server RandR ChangeProviderProperty Heap Buffer Overflow
7.8
CVE-2026-93520
X.Org Server XKB ChangeKeycodeRange Heap Out-of-Bounds Write
7.8
CVE-2026-93519
X.Org Server XFixes Pointer Barrier Event List Buffer Overflow