Description
An out-of-bounds memory access flaw was found in the X.Org server. This issue can be triggered when a device frozen by a sync grab is reattached to a different master device. This issue may lead to an application crash, local privilege escalation (if the server runs with extended privileges), or remote code execution in SSH X11 forwarding environments.
Affected products
x.org: x server; x.org: xwayland; fedoraproject: fedora; redhat: enterprise linux; redhat: enterprise linux aus; redhat: enterprise linux eus; redhat: enterprise linux tus; redhat: enterprise linux update services for sap solutions
References10
- access.redhat.com/errata/RHSA-2024:0320 Third Party Advisory
- access.redhat.com/errata/RHSA-2024:0557 Third Party Advisory
- access.redhat.com/errata/RHSA-2024:0558 Third Party Advisory
- access.redhat.com/errata/RHSA-2024:0597 Third Party Advisory
- access.redhat.com/errata/RHSA-2024:0607 Third Party Advisory
- access.redhat.com/errata/RHSA-2024:0614 Third Party Advisory
- access.redhat.com/errata/RHSA-2024:0617 Third Party Advisory
- access.redhat.com/errata/RHSA-2024:0621 Third Party Advisory
- access.redhat.com/errata/RHSA-2024:0626 Third Party Advisory
- access.redhat.com/errata/RHSA-2024:0629 Third Party Advisory
Metrics
- CVSS 3.1
-
7.8
HIGH
Score source: NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 1% percentile: 69 · as of 5 November 2026
- CWE
- CWE-787
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.