CVE-2024-21885CWE-122

Xorg-x11-server: heap buffer overflow in xisenddevicehierarchyevent

High · published February 28, 2024

CVSS v3.1
7.8
EPSS
1%
Percentile
72.6
In the wild
Unconfirmed
What it is

A flaw was found in X.Org server. In the XISendDeviceHierarchyEvent function, it is possible to exceed the allocated array length when certain new device IDs are added to the xXIHierarchyInfo struct. This can trigger a heap buffer overflow condition, which may lead to an application crash or remote code execution in SSH X11 forwarding environments.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01420 · 72.6th percentile
Weakness
CWE-122 · Heap-based Buffer Overflow
Published
2024-02-28T12:11Z
EPSS history
Timeline
  • 28 FEB 12:11Z
    Xorg-x11-server: heap buffer overflow in xisenddevicehierarchyevent
    cvelistv5