Xorg X Server

Use-after-Free in X.Org and Xwayland Root Cursor Handling
CVE-2025-26594 7.8 - High - February 25, 2025

A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a global variable. If a client frees the root cursor, the internal reference points to freed memory and causes a use-after-free.

Dangling pointer

X.Org Xwayland Buffer Overflow via XkbVModMaskText
CVE-2025-26595 7.8 - High - February 25, 2025

A buffer overflow flaw was found in X.Org and Xwayland. The code in XkbVModMaskText() allocates a fixed-sized buffer on the stack and copies the names of the virtual modifiers to that buffer. The code fails to check the bounds of the buffer and would copy the data regardless of the size.

Stack Overflow

Heap Overflow in X.Org X Server XkbSizeKeySyms Length Calc
CVE-2025-26596 7.8 - High - February 25, 2025

A heap overflow flaw was found in X.Org and Xwayland. The computation of the length in XkbSizeKeySyms() differs from what is written in XkbWriteKeySyms(), which may lead to a heap-based buffer overflow.

Memory Corruption

Buffer Overflow in X.Org Xwayland via XkbChangeTypesOfKey() misuse
CVE-2025-26597 7.8 - High - February 25, 2025

A buffer overflow flaw was found in X.Org and Xwayland. If XkbChangeTypesOfKey() is called with a 0 group, it will resize the key symbols table to 0 but leave the key actions unchanged. If the same function is later called with a non-zero value of groups, this will cause a buffer overflow because the key actions are of the wrong size.

Buffer Overflow

OOB Write in X.Org/Xwayland via GetBarrierDevice()
CVE-2025-26598 7.8 - High - February 25, 2025

An out-of-bounds write flaw was found in X.Org and Xwayland. The function GetBarrierDevice() searches for the pointer device based on its device ID and returns the matching value, or supposedly NULL, if no match was found. However, the code will return the last element of the list if no matching device ID is found, which can lead to out-of-bounds memory access.

Memory Corruption

Uninitialized pointer flaw in X.Org X server compCheckRedirect()
CVE-2025-26599 7.8 - High - February 25, 2025

An access to an uninitialized pointer flaw was found in X.Org and Xwayland. The function compCheckRedirect() may fail if it cannot allocate the backing pixmap. In that case, compRedirectWindow() will return a BadAlloc error without validating the window tree marked just before, which leaves the validated data partly initialized and the use of an uninitialized pointer later.

Access of Uninitialized Pointer

UAF in X.Org/XWayland via orphaned input events
CVE-2025-26600 7.8 - High - February 25, 2025

A use-after-free flaw was found in X.Org and Xwayland. When a device is removed while still frozen, the events queued for that device remain while the device is freed. Replaying the events will cause a use-after-free.

Dangling pointer

Use-after-Free in X.Org/Xwayland SyncInitTrigger
CVE-2025-26601 7.8 - High - February 25, 2025

A use-after-free flaw was found in X.Org and Xwayland. When changing an alarm, the values of the change mask are evaluated one after the other, changing the trigger values as requested, and eventually, SyncInitTrigger() is called. If one of the changes triggers an error, the function will return early, not adding the new sync object, possibly causing a use-after-free when the alarm eventually triggers.

Dangling pointer

X.Org Server OOB Memory Access: Priv Esc & RCE via X11 SSH
CVE-2024-0229 7.8 - High - February 09, 2024

An out-of-bounds memory access flaw was found in the X.Org server. This issue can be triggered when a device frozen by a sync grab is reattached to a different master device. This issue may lead to an application crash, local privilege escalation (if the server runs with extended privileges), or remote code execution in SSH X11 forwarding environments.

Memory Corruption

CVE-2023-5367: OOB Write in Xorg X11 Server XIChangeDeviceProperty
CVE-2023-5367 7.8 - High - October 25, 2023

A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect calculation of a buffer offset when copying data stored in the heap in the XIChangeDeviceProperty function in Xi/xiproperty.c and in RRChangeOutputProperty function in randr/rrproperty.c, allowing for possible escalation of privileges or denial of service.

Memory Corruption

Use-After-Free in X.Org X11 Server (Zaphod Mode) Crashes X Server
CVE-2023-5380 4.7 - Medium - October 25, 2023

A use-after-free flaw was found in the xorg-x11-server. An X server crash may occur in a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode) if the pointer is warped from within a window on one screen to the root window of the other screen and if the original window is destroyed followed by another window being destroyed.

Dangling pointer

Use-After-Free in Xvfb Zaphod Mode Enables Privilege Escalation
CVE-2023-5574 7 - High - October 25, 2023

A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.

Dangling pointer

X.org X Server Priv Escalation via dangling pointer in DeepCopyPointerClasses
CVE-2023-0494 7.8 - High - March 27, 2023

A vulnerability was found in X.Org. This issue occurs due to a dangling pointer in DeepCopyPointerClasses that can be exploited by ProcXkbSetDeviceInfo() and ProcXkbGetDeviceInfo() to read and write into freed memory. This can lead to local privilege elevation on systems where the X server runs privileged and remote code execution for ssh X forwarding sessions.

Dangling pointer

DoS via malformed X11Controller.m in XQuartz
CVE-2022-3553 6.5 - Medium - October 17, 2022

A vulnerability, which was classified as problematic, was found in X.org Server. This affects an unknown part of the file hw/xquartz/X11Controller.m of the component xquartz. The manipulation leads to denial of service. It is recommended to apply a patch to fix this issue. The identifier VDB-211053 was assigned to this vulnerability.

Improper Resource Shutdown or Release

X.org Server: _GetCountedString Buffer Overflow
CVE-2022-3550 8.8 - High - October 17, 2022

A vulnerability classified as critical was found in X.org Server. Affected by this vulnerability is the function _GetCountedString of the file xkb/xkb.c. The manipulation leads to buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211051.

Buffer Overflow

Mem leak in X.org Server ProcXkbGetKbdByName
CVE-2022-3551 6.5 - Medium - October 17, 2022

A vulnerability, which was classified as problematic, has been found in X.org Server. Affected by this issue is the function ProcXkbGetKbdByName of the file xkb/xkb.c. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211052.

Improper Resource Shutdown or Release

A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14
CVE-2021-4008 7.8 - High - December 17, 2021

A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in the SProcRenderCompositeGlyphs function. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Buffer Overflow

A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14
CVE-2021-4009 7.8 - High - December 17, 2021

A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in the SProcXFixesCreatePointerBarrier function. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Buffer Overflow

A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14
CVE-2021-4010 7.8 - High - December 17, 2021

A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in the SProcScreenSaverSuspend function. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Buffer Overflow

A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14
CVE-2021-4011 7.8 - High - December 17, 2021

A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in the SwapCreateRegister function. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Buffer Overflow

A privilege escalation flaw was found in the Xorg-x11-server due to a lack of authentication for X11 clients
CVE-2020-25697 7 - High - May 26, 2021

A privilege escalation flaw was found in the Xorg-x11-server due to a lack of authentication for X11 clients. This flaw allows an attacker to take control of an X application by impersonating the server it is expecting to connect to.

Missing Authentication for Critical Function

A flaw was found in xorg-x11-server in versions before 1.20.11
CVE-2021-3472 7.8 - High - April 26, 2021

A flaw was found in xorg-x11-server in versions before 1.20.11. An integer underflow can occur in xserver which can lead to a local privilege escalation. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Integer underflow

A flaw was found in the X.Org Server before version 1.20.10
CVE-2020-14360 7.8 - High - January 20, 2021

A flaw was found in the X.Org Server before version 1.20.10. An out-of-bounds access in the XkbSetMap function may lead to a privilege escalation vulnerability. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Buffer Overflow

A flaw was found in xorg-x11-server before 1.20.10
CVE-2020-25712 7.8 - High - December 15, 2020

A flaw was found in xorg-x11-server before 1.20.10. A heap-buffer overflow in XkbSetDeviceInfo may lead to a privilege escalation vulnerability. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Heap-based Buffer Overflow

A flaw was found in X.Org Server before xorg-x11-server 1.20.9
CVE-2020-14345 7.8 - High - September 15, 2020

A flaw was found in X.Org Server before xorg-x11-server 1.20.9. An Out-Of-Bounds access in XkbSetNames function may lead to a privilege escalation vulnerability. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Buffer Overflow

"" In X.Org X Server 1.20.4, there is a stack-based buffer overflow in the function XQueryKeymap
CVE-2019-17624 - October 16, 2019

"" In X.Org X Server 1.20.4, there is a stack-based buffer overflow in the function XQueryKeymap. For example, by sending ct.c_char 1000 times, an attacker can cause a denial of service (application crash) or possibly have unspecified other impact. Note: It is disputed if the X.Org X Server is involved or if there is a stack overflow.

The X.Org X wrapper (xserver-wrapper.c) in Debian GNU/Linux and Ubuntu Linux does not properly verify the TTY of a user who is starting X, which allows local users to bypass intended access restrictions by associating stdin with a file
CVE-2011-4613 - February 05, 2014

The X.Org X wrapper (xserver-wrapper.c) in Debian GNU/Linux and Ubuntu Linux does not properly verify the TTY of a user who is starting X, which allows local users to bypass intended access restrictions by associating stdin with a file that is misinterpreted as the console TTY.

Permissions, Privileges, and Access Controls

Integer underflow in the pixman_trapezoid_valid macro in pixman.h in Pixman before 0.32.0, as used in X.Org server and cairo
CVE-2013-6425 - January 18, 2014

Integer underflow in the pixman_trapezoid_valid macro in pixman.h in Pixman before 0.32.0, as used in X.Org server and cairo, allows context-dependent attackers to cause a denial of service (crash) via a negative bottom value.

Integer underflow in the xTrapezoidValid macro in render/picture.h in X.Org
CVE-2013-6424 - January 18, 2014

Integer underflow in the xTrapezoidValid macro in render/picture.h in X.Org allows context-dependent attackers to cause a denial of service (crash) via a negative bottom value.

The LockServer function in os/utils.c in X.Org xserver before 1.11.2
CVE-2011-4028 - July 03, 2012

The LockServer function in os/utils.c in X.Org xserver before 1.11.2 allows local users to determine the existence of arbitrary files via a symlink attack on a temporary lock file, which is handled differently if the file exists.

insecure temporary file

The LockServer function in os/utils.c in X.Org xserver before 1.11.2
CVE-2011-4029 - July 03, 2012

The LockServer function in os/utils.c in X.Org xserver before 1.11.2 allows local users to change the permissions of arbitrary files to 444, read those files, and possibly cause a denial of service (removed execution permission) via a symlink attack on a temporary lock file.

Race Condition