X.Org X server vulnerabilities

A flaw was found in the X.Org X server related to an out-of-bounds read affecting XKB modifier map handling. An attacker with access to the X11 server can exploit this by sending a malformed request, leading to reading beyond intended memory boundaries.

A flaw was found in the X.Org X server that allows for out-of-bounds memory read in XKB geometry processing. An attacker can exploit this vulnerability to read uninitialized memory or out-of-bounds memory, potentially leading to memory disclosure or server crashes.

In the X.Org X server before 2017-06-19, a user authenticated to an X Session could crash or execute code in the context of the X Server by exploiting a stack overflow in the endianness conversion of X Events.

An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat. A client requesting multiple DRI2BufferBackLeft attachments and one DRI2BufferFrontLeft can trigger an out-of-bounds heap write.

A use-after-free vulnerability was found in the X.Org X server and Xwayland in the CreateSaverWindow() function. A client can trigger a use-after-free read by changing window attributes and forcing the screen saver, leading to information disclosure.

An out-of-bounds read flaw was found in the X.Org X server and Xwayland in __glXDisp_ChangeDrawableAttributes(). A wrong size validation check can read a client-controlled number of bytes, exceeding the request buffer, leading to information disclosure. A write path also exists but requires byte-swapped clients which is disabled by default.

A use-after-free vulnerability was found in the X.Org X server and Xwayland in the SyncChangeCounter() function. A client setting up multiple SyncCounters can trigger this flaw by destroying those counters via a second client connection while they are being changed.

A use-after-free vulnerability was found in the X.Org X server and Xwayland in the FreeCounter() function. A client that sets up multiple SyncCounters and awaits on those triggers can trigger the flaw when destroying those counters via a second client connection.

A stack-based buffer overflow vulnerability was found in the X.Org X server and Xwayland. The _XkbSetMapChecks() function declares a fixed-size stack buffer mapWidths[256] indexed by key type, and the helper CheckKeyTypes() writes to it at a client-controlled offset, causing overflow.

A stack-based buffer overflow vulnerability was found in the X.Org X server and Xwayland. The CheckKeyTypes() function does not verify or clamp non-canonical key types to XkbMaxShiftLevel, allowing a client to set excessive shift levels and trigger stack overflows. This is caused by an incomplete fix of CVE-2025-26597.

A use-after-free vulnerability was found in the X.Org X server and Xwayland in the miSyncDestroyFence() function. A client setting up multiple fence triggers can cause a use-after-free function pointer call. An attacker connects to the X server to set up a fence and await it, then a second X connection destroys the fence, leading to use-after-free.

A stack-based buffer overflow vulnerability was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library's maximum font name length causes a stack buffer overflow during font alias resolution. The server allocates a 256-byte stack buffer but libXfont2's alias target name length is 1024 bytes, allowing an attacker to write beyond the buffer.

A flaw was found in the X.Org X server's XKB key types request validation. A local attacker can send a specially crafted request, causing an out-of-bounds memory access.

A use-after-free vulnerability was found in the X.Org X server in the miSyncTriggerFence() function handling XSYNC fences. An attacker with access to the X11 server can exploit this without user interaction, causing a server crash and potentially memory corruption.

A flaw was found in the X.Org X server. This integer underflow vulnerability in the XKB compatibility map handling allows an attacker with local or remote X11 server access to trigger a buffer read overrun, potentially leading to memory-safety violations and denial of service (DoS) or other severe impacts.

A flaw was discovered in the X.Org X server's X Keyboard (Xkb) extension during client resource cleanup. The software frees data structures without properly detaching related resources, leading to a use-after-free condition. This can cause memory corruption or a crash when affected clients disconnect.

A flaw was identified in the X.Org X server's X Keyboard (Xkb) extension where improper bounds checking in the XkbSetCompatMap() function can cause an unsigned short overflow. Sending specially crafted input data may overflow the value calculation, leading to memory corruption or a crash.