{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/x-wayland--24.1.14/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:x.org:x_server:*:*:*:*:*:*:*:*","cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-88812"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["X Server (\u003c 21.1.25)","X Wayland (\u003c 24.1.14)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","memory-corruption"],"_cs_type":"advisory","_cs_vendors":["X.Org"],"content_html":"\u003cp\u003eCVE-2026-88812 is a memory corruption vulnerability involving a double-free condition in the XKB (X Keyboard Extension) SetGeometry implementation. This flaw affects versions of X.Org X Server prior to 21.1.25 and X Wayland prior to 24.1.14. An attacker with the ability to connect as a client to the X server can exploit this vulnerability to trigger a crash, resulting in a denial of service, or potentially gain arbitrary code execution within the context of the X server process.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation may lead to a crash of the X server process (Denial of Service) or arbitrary code execution under the privileges of the X server instance.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade X.Org X Server to version 21.1.25 or later.\u003c/li\u003e\n\u003cli\u003eUpgrade X Wayland to version 24.1.14 or later.\u003c/li\u003e\n\u003cli\u003eReview system audit logs for repeated X server process restarts, which may indicate exploit attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-28T02:16:18Z","date_published":"2026-10-28T02:16:18Z","id":"https://feed.craftedsignal.io/briefs/2026-10-xorg-xkb-double-free/","summary":"A double-free vulnerability in the XKB SetGeometry implementation in X.Org X Server and X Wayland allows local clients to cause a denial of service or potential arbitrary code execution.","title":"X.Org X Server and X Wayland: Double free vulnerability in XKB SetGeometry (CVE-2026-88812)","url":"https://feed.craftedsignal.io/briefs/2026-10-xorg-xkb-double-free/"}],"language":"en","title":"CraftedSignal Threat Feed - X Wayland (\u003c 24.1.14)","version":"https://jsonfeed.org/version/1.1"}