Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 209

Export CSV
CVE-2025-26599

Xorg: xwayland: use of uninitialized pointer in compredirectwindow()

An access to an uninitialized pointer flaw was found in X.Org and Xwayland. The function compCheckRedirect() may fail if it cannot allocate the backing pixmap. In that case, compRedirectWindow() will return a BadAlloc error without validating the window tree marked just before, which leaves the validated data partly initialized and the use of an uninitialized pointer later.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat Tigervnc X.org
Products
Enterprise Linux Rhel Aus Rhel E4s and 6 more
CVE-2025-26597

Xorg: xwayland: buffer overflow in xkbchangetypesofkey()

A buffer overflow flaw was found in X.Org and Xwayland. If XkbChangeTypesOfKey() is called with a 0 group, it will resize the key symbols table to 0 but leave the key actions unchanged. If the same function is later called with a non-zero value of groups, this will cause a buffer overflow because the key actions are of the wrong size.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat Tigervnc X.org
Products
Enterprise Linux Rhel Aus Rhel E4s and 6 more
CVE-2025-26596

Xorg: xwayland: heap overflow in xkbwritekeysyms()

A heap overflow flaw was found in X.Org and Xwayland. The computation of the length in XkbSizeKeySyms() differs from what is written in XkbWriteKeySyms(), which may lead to a heap-based buffer overflow.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat Tigervnc X.org
Products
Enterprise Linux Rhel Aus Rhel E4s and 6 more
CVE-2025-26595

Xorg: xwayland: buffer overflow in xkbvmodmasktext()

A buffer overflow flaw was found in X.Org and Xwayland. The code in XkbVModMaskText() allocates a fixed-sized buffer on the stack and copies the names of the virtual modifiers to that buffer. The code fails to check the bounds of the buffer and would copy the data regardless of the size.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat Tigervnc X.org
Products
Enterprise Linux Rhel Aus Rhel E4s and 6 more
CVE-2025-26594

X.org: xwayland: use-after-free of the root cursor

A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a global variable. If a client frees the root cursor, the internal reference points to freed memory and causes a use-after-free.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat Tigervnc X.org
Products
Enterprise Linux Rhel Aus Rhel E4s and 6 more
CVE-2026-88812

X.Org Server XKB SetGeometry TextDoodad Double Free

A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a crash or potentially code in the x server context.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
X.org
Products
Xorg-server Xorg-x11-server Xwayland
CVE-2026-109090

libXi XGetDeviceControl DEVICE_ENABLE Heap Buffer Overflow

A malicious X server could cause a heap overflow by injecting a large DEVICE_ENABLE reply when processed by libXi before 1.8.4.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
X.org
Products
Libxi
CVE-2026-109089

libXi XGetDeviceControl Control Type Mismatch Heap Buffer Overflow

A buffer overflow when handling DEVICE_RESOLUTION in libXi before 1.8.4 could overflow a heap, triggered by a malicious X server.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
X.org
Products
Libxi
CVE-2024-0409

Xorg-x11-server: selinux context corruption

A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cursor bits type with the cursor as private, and when initiating the cursor, that overwrites the XSELINUX context.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat Tigervnc and 1 more
Products
Fedora Enterprise Linux Enterprise Linux Desktop and 10 more
CVE-2024-0408

Xorg-x11-server: selinux unlabeled glx pbuffer

A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the buffer, leaving it unlabeled. When the client issues another request to access that resource (as with a GetGeometry) or when it creates another resource that needs to access that buffer, such as a GC, the XSELINUX code will try to use an object that was never labeled and crash because the SID is NULL.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat Tigervnc and 1 more
Products
Fedora Enterprise Linux Enterprise Linux Desktop and 10 more
CVE-2024-0229

Xorg-x11-server: reattaching to different master device may lead to out-of-bounds memory access

An out-of-bounds memory access flaw was found in the X.Org server. This issue can be triggered when a device frozen by a sync grab is reattached to a different master device. This issue may lead to an application crash, local privilege escalation (if the server runs with extended privileges), or remote code execution in SSH X11 forwarding environments.

CVSS 3.1 · 7.8 High EPSS 1.2% KEV · Not listed
Vendors
Fedoraproject Redhat X.org
Products
Fedora Enterprise Linux Enterprise Linux Aus and 10 more
CVE-2023-6816

Xorg-x11-server: heap buffer overflow in devicefocusevent and procxiquerypointer

A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbitrarily mapped to any value up to 255, but the X.Org Server was only allocating space for the device's particular number of buttons, leading to a heap overflow if a bigger value was used.

CVSS 3.1 · 9.8 Critical EPSS 2.1% KEV · Not listed
Vendors
Debian Fedoraproject Redhat and 1 more
Products
Debian Linux Fedora Enterprise Linux and 10 more
CVE-2023-6377

Xorg-x11-server: out-of-bounds memory reads/writes in xkb button actions

A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to a mouse can result in out-of-bounds memory reads and writes. This may allow local privilege escalation or possible remote code execution in cases where X11 forwarding is involved.

CVSS 3.1 · 7.8 High EPSS 1.6% KEV · Not listed
Vendors
Debian Redhat Tigervnc and 1 more
Products
Debian Linux Enterprise Linux Enterprise Linux Eus and 8 more
CVE-2023-6478

Xorg-x11-server: out-of-bounds memory read in rrchangeoutputproperty and rrchangeproviderproperty

A flaw was found in xorg-server. A specially crafted request to RRChangeProviderProperty or RRChangeOutputProperty can trigger an integer overflow which may lead to a disclosure of sensitive information.

CVSS 3.1 · 7.6 High EPSS 1.6% KEV · Not listed
Vendors
Debian Redhat Tigervnc and 1 more
Products
Debian Linux Enterprise Linux Enterprise Linux Eus and 8 more
CVE-2023-5574

Xorg-x11-server: use-after-free bug in damagedestroy

A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Redhat X.org
Products
Enterprise Linux Rhel Els X Server
CVE-2023-5367

Xorg-x11-server: out-of-bounds write in xichangedeviceproperty/rrchangeoutputproperty

A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect calculation of a buffer offset when copying data stored in the heap in the XIChangeDeviceProperty function in Xi/xiproperty.c and in RRChangeOutputProperty function in randr/rrproperty.c, allowing for possible escalation of privileges or denial of service.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Redhat and 1 more
Products
Debian Linux Fedora Enterprise Linux and 14 more
CVE-2026-109088

libXtst RECORD EnableContext Reply Endless Loop

A malicious X server could send malformed  RECORD EnableContext reolies that can cause a X client using the parse_reply_call_callback function in libXtst before 1.2.6 to enter a endless loop.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
X.org
Products
Libxtst
CVE-2026-94282

Out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion

An out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion in libXi before 1.8.4 could be used by malicious X server to crash an attached X client.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
Libxi X.org
Products
Libxi Libxi
CVE-2026-94286

Out-of-bounds read in libXtst's RECORD reply parser

An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
X.org
Products
Libxtst
CVE-2026-94285

Out-of-bounds read in libX11's byte-oriented codeset parser

An out-of-bounds read in libX11's byte-oriented codeset parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients.

CVSS 3.1 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
X.org
Products
Libx11