CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbitrarily mapped to any value up to 255, but the X.Org Server was only allocating space for the device's particular number of buttons, leading to a heap overflow if a bigger value was used.
AnalysisAI
A heap overflow vulnerability exists in X.Org Server and Xwayland where improper memory allocation for logical button mappings allows remote attackers to execute arbitrary code with high privileges. The flaw affects multiple Linux distributions including RHEL 7, Fedora 39, and Debian 10, with a critical CVSS score of 9.8 and an EPSS score of 3.26% (87th percentile), indicating moderate real-world exploitation likelihood. Multiple security advisories have been issued by Red Hat with patches available, though no evidence of active exploitation (not in KEV) or public proof-of-concept exists.
Technical ContextAI
The vulnerability affects X.Org X Server (all versions) and Xwayland (all versions) as identified by CPE entries cpe:2.3:a:x.org:x_server and cpe:2.3:a:x.org:xwayland. The flaw is classified as CWE-787 (Out-of-bounds Write), occurring in the DeviceFocusEvent and XIQueryPointer reply mechanisms which contain bit representations for each logical button currently pressed. While the X11 protocol allows buttons to be mapped to values up to 255, the X.Org Server only allocates memory based on the actual number of buttons on the device, creating a heap buffer overflow condition when higher button values are used.
RemediationAI
Apply the vendor-provided security updates immediately, with Red Hat patches available via advisories RHSA-2024:0320, RHSA-2024:0557, RHSA-2024:0558, RHSA-2024:0597, RHSA-2024:0607, RHSA-2024:0614, RHSA-2024:0617, RHSA-2024:0621, RHSA-2024:0626, RHSA-2024:0629, RHSA-2024:2169, RHSA-2024:2170, RHSA-2024:2995, RHSA-2024:2996, and RHSA-2025:12751 (see https://access.redhat.com/errata/ for details). For systems that cannot be immediately patched, consider restricting network access to X11 services (typically port 6000) at the firewall level and disabling remote X11 connections where not required, though these are only partial mitigations for a memory corruption vulnerability.
Share
External POC / Exploit Code
Leaving vuln.today