CVE-2023-3138
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk74th percentile - higher than 74% of all known CVEs
Summary
A vulnerability was found in libX11 due to a lack of checks on values passed to functions in src/InitExt.c. These values are used as array indexes, which can lead to overwriting other parts of the Display structure, potentially causing the client to crash due to memory corruption.
Risk Assessment
This vulnerability poses a risk of crashing client applications using libX11, which may lead to service disruptions. A malicious server or proxy could exploit this flaw to destabilize the system.
Recommendation
It is recommended to update libX11 to the latest version that includes security fixes. Additionally, monitoring and verifying the sources of X servers should be implemented to minimize the risk of attacks.
Other vulnerabilities in libX11
See all- CVE-2026-94285Medium
An out-of-bounds read in libX11's byte-oriented codeset parser before 1.8.14 could be used by malicious X servers to crash attached X clients.
- CVE-2026-94284Medium
An out-of-bounds read vulnerability in libX11's XIM trigger-key registration parser before 1.8.14 could be used by malicious X servers to crash attached X clients.
- CVE-2026-94283Medium
An out-of-bounds read vulnerability in libX11's XIM attribute parser before 1.8.14 could be used by malicious X servers to crash attached X clients.
- CVE-2026-88806High
A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map.
Original NVD description (English source)
A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that the values provided for the Request, Event, or Error IDs are within the bounds of the arrays that those functions write to, using those IDs as array indexes. They trust that they were called with values provided by an Xserver adhering to the bounds specified in the X11 protocol, as all X servers provided by X.Org do. As the protocol only specifies a single byte for these values, an out-of-bounds value provided by a malicious server (or a malicious proxy-in-the-middle) can only overwrite other portions of the Display structure and not write outside the bounds of the Display structure itself, possibly causing the client to crash with this memory corruption.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS