X.Org X server vulnerabilities

A use-after-free caused by lack of lifecycle management when adding or removing XInput master devices exists in X.org X Server before 21.1.25 and XWayland before 24.1.14. An authenticated X client could exploit this to crash the X server or potentially execute code in the X server context.

A use-after-free in present_clear_window_notifies() in X.org X Server before 21.1.25 and XWayland before 24.1.14 could be exploited by malicious X clients to crash the server or potentially execute code in the X server context.

In the X.Org X server before 2017-06-19, a user authenticated to an X Session could crash or execute code in the context of the X Server by exploiting a stack overflow in the endianness conversion of X Events.

A use-after-free caused by missing lifecycle management of gesture sprites in GestureBuildSprite() exists in X.Org X Server before 21.1.25 and XWayland before 24.1.14. An authenticated X client could exploit it to crash the X server or potentially execute code.

A buffer overread in CheckKeySyms() exists in X.Org X Server before 21.1.25 and XWayland before 24.1.14. An authenticated X client could exploit it to leak small amounts of information from X server memory or potentially crash the X server.

A heap buffer overflow in X.Org X Server before 21.1.15 and XWayland before 24.1.14 is triggered by an XIPassiveUngrabDevice request with an out-of-range modifier value. An authenticated X client could exploit this to crash the X server or potentially execute code in the server context.

A heap buffer overflow caused by mismatched size usage in the CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14. Authenticated X clients could use it to crash the server or potentially execute code in the X server context.

A buffer overflow in RandR ChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14. Authenticated X clients could use it to crash the server or execute code within the X server context.

A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange exists in X.org X server before 2.1.25 and XWayland before 24.1.14. Authenticated X clients could exploit it to crash or potentially execute code in the X server context.

A buffer overflow when handling pointer barriers in the XFIXES extension exists in X.Org X server before 21.1.25 and XWayland before 24.1.14. Authenticated X clients could exploit it to crash or potentially execute code in the X server context.

An integer truncation issue in XkbResizeKeyType() that could lead to a heap buffer overflow exists in X.org X server before 21.1.25 and XWayland before 24.1.14. Authenticated X clients could exploit it for crashes or potential code execution in the X server.

A heap buffer overflow in handling GLX RenderLarge requests where dataBytes exceeds cmdlen exists in X.org X server before 21.1.25 and XWayland before 24.1.14. It can be triggered by an authenticated X client and cause crashes or code execution in the X server context.

A double free in XKB SetGeometry in X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a crash or potentially execute code in the X server context.

An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat. A client requesting multiple DRI2BufferBackLeft attachments and one DRI2BufferFrontLeft can trigger an out-of-bounds heap write.

A use-after-free vulnerability was found in the X.Org X server and Xwayland in the CreateSaverWindow() function. A client can trigger a use-after-free read by changing window attributes and forcing the screen saver, leading to information disclosure.

An out-of-bounds read flaw was found in the X.Org X server and Xwayland in __glXDisp_ChangeDrawableAttributes(). A wrong size validation check can read a client-controlled number of bytes, exceeding the request buffer, leading to information disclosure. A write path also exists but requires byte-swapped clients which is disabled by default.

A use-after-free vulnerability was found in the X.Org X server and Xwayland in the SyncChangeCounter() function. A client setting up multiple SyncCounters can trigger this flaw by destroying those counters via a second client connection while they are being changed.

A use-after-free vulnerability was found in the X.Org X server and Xwayland in the FreeCounter() function. A client that sets up multiple SyncCounters and awaits on those triggers can trigger the flaw when destroying those counters via a second client connection.

A stack-based buffer overflow vulnerability was found in the X.Org X server and Xwayland. The _XkbSetMapChecks() function declares a fixed-size stack buffer mapWidths[256] indexed by key type, and the helper CheckKeyTypes() writes to it at a client-controlled offset, causing overflow.

A stack-based buffer overflow vulnerability was found in the X.Org X server and Xwayland. The CheckKeyTypes() function does not verify or clamp non-canonical key types to XkbMaxShiftLevel, allowing a client to set excessive shift levels and trigger stack overflows. This is caused by an incomplete fix of CVE-2025-26597.

A use-after-free vulnerability was found in the X.Org X server and Xwayland in the miSyncDestroyFence() function. A client setting up multiple fence triggers can cause a use-after-free function pointer call. An attacker connects to the X server to set up a fence and await it, then a second X connection destroys the fence, leading to use-after-free.

A stack-based buffer overflow vulnerability was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library's maximum font name length causes a stack buffer overflow during font alias resolution. The server allocates a 256-byte stack buffer but libXfont2's alias target name length is 1024 bytes, allowing an attacker to write beyond the buffer.

A flaw was found in the X.Org X server related to an out-of-bounds read affecting XKB modifier map handling. An attacker with access to the X11 server can exploit this by sending a malformed request, leading to reading beyond intended memory boundaries.

A flaw was found in the X.Org X server that allows for out-of-bounds memory read in XKB geometry processing. An attacker can exploit this vulnerability to read uninitialized memory or out-of-bounds memory, potentially leading to memory disclosure or server crashes.

A flaw was found in the X.Org X server's XKB key types request validation. A local attacker can send a specially crafted request, causing an out-of-bounds memory access.

A use-after-free vulnerability was found in the X.Org X server in the miSyncTriggerFence() function handling XSYNC fences. An attacker with access to the X11 server can exploit this without user interaction, causing a server crash and potentially memory corruption.

A flaw was found in the X.Org X server. This integer underflow vulnerability in the XKB compatibility map handling allows an attacker with local or remote X11 server access to trigger a buffer read overrun, potentially leading to memory-safety violations and denial of service (DoS) or other severe impacts.

A flaw was discovered in the X.Org X server's X Keyboard (Xkb) extension during client resource cleanup. The software frees data structures without properly detaching related resources, leading to a use-after-free condition. This can cause memory corruption or a crash when affected clients disconnect.

A flaw was identified in the X.Org X server's X Keyboard (Xkb) extension where improper bounds checking in the XkbSetCompatMap() function can cause an unsigned short overflow. Sending specially crafted input data may overflow the value calculation, leading to memory corruption or a crash.