Bug 2545887 (CVE-2026-93519)

Summary: CVE-2026-93519 xorg-x11-server: xorg-x11-server: Arbitrary code execution via buffer overflow in input_constrain_cursor()
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, security-response-team, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in xorg-x11-server. The server writes pointer barrier events into a fixed-size buffer without properly validating boundaries. An authenticated client can trigger this issue by configuring excessive pointer barriers and generating cursor motion events, causing a buffer overflow. This vulnerability may lead to arbitrary code execution or cause the server to crash, resulting in a Denial of Service (DoS).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2026-10-07   

Description OSIDB Bzimport 2026-10-05 11:38:03 UTC 
input_constrain_cursor() writes barrier events into a fixed-size buffer
     without checking bounds. When more than 100 pointer barriers are active,
     the writes overflow the fixed buffer on the stack or heap.

     An authenticated X client can trigger this by creating more than 100
     pointer barriers (using the XFIXES extension) and then generating pointer
     motion events (e.g. via XTEST). Both extensions are enabled by default.

     The buffer overflow can lead to arbitrary code execution or denial of
     service.

     Fixed in: xorg-server-21.1.25 and xwayland-24.1.14