In XkbResizeKeyType(), the size_syms variable is declared as unsigned short. The expression (nTotal * 15) / 10 can exceed 65535 for large nTotal values, and the result is truncated when assigned to the unsigned short variable. This causes an undersized allocation, and subsequent writes overflow the heap buffer.

An authenticated X client can trigger this by sending XKB requests that cause a key type resize with a sufficiently large nTotal value.
The heap buffer overflow resulting from the truncated allocation can lead to arbitrary code execution or denial of service.

NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/5ec0535af2bcc93381666dc110abebba8975f8ae (xorg-server-21.1.25)