{}

{}

{}

{"bugzilla": {"description": "xorg-x11-server: GestureBuildSprite Use-After-Free", "id": "2545949", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545949"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["A flaw was found in the X.Org Server. When a window is removed during an active gesture, the server fails to clean up references to the destroyed window in its gesture tracking data. A local attacker can exploit this flaw to cause a use-after-free condition\u2014where the system accesses memory after it has been released\u2014potentially leading to unauthorized information disclosure or a denial of service (DoS)."], "name": "CVE-2026-93536", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "xorg-x11-server-Xwayland", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "xorg-x11-server", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "xorg-x11-server", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "xorg-x11-server", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "xorg-x11-server-Xwayland", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "xorg-x11-server", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "xorg-x11-server-Xwayland", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-10-07T12:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-93536\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-93536"], "statement": "This vulnerability is rated with a Low severity on Red Hat systems because triggering it requires local access to an active graphical session and the impact is confined to a minor memory read or potential session crash rather than arbitrary code execution. Standard server installations without a desktop environment do not run Xorg or Xwayland and are not exposed. In graphical workstation environments, the flaw can only be triggered under specific timing conditions when a window is closed while gesture input events are being processed.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 75.0, "confidence_source": "inferred", "scores": [{"score": 75.0, "source": "inferred"}, {"score": 90.0, "source": "matching"}]}, "product": "x_server", "vendor": "x.org"}], "created": "2026-10-08T14:15:15.005643+00:00", "updated": "2026-10-19T12:52:53.334598+00:00", "vendors": ["x.org", "x.org$PRODUCT$x_server"]}