Xorg-x11-server: out-of-bounds memory reads/writes in xkb button actions

Summary

A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to a mouse can result in out-of-bounds memory reads and writes. This may allow local privilege escalation or possible remote code execution in cases where X11 forwarding is involved.

Timeline

1. Dec 13, 2023, 6:27 AM UTCCVE published
2. Dec 13, 2023, 3:25 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Jun 23, 2026, 5:19 PM UTCRecord last updated

Affected versions

• tigervnc

  Version range not reported

• tigervnc

  Version range not reported

• xorg-x11-server

  Version range not reported

• tigervnc

  Version range not reported

• xorg-x11-server

  Version range not reported

• xorg-x11-server-Xwayland

  Version range not reported

• tigervnc

  Version range not reported

• tigervnc

  Version range not reported

• tigervnc

  Version range not reported

• tigervnc

  Version range not reported

• tigervnc

  Version range not reported

• tigervnc

  Version range not reported

• tigervnc

  Version range not reported

• tigervnc

  Version range not reported

• tigervnc

  Version range not reported

• xorg-x11-server

  Version range not reported

• xorg-x11-server-Xwayland

  Version range not reported

• tigervnc

  Version range not reported

• tigervnc

  Version range not reported

• xorg-x11-server

  Version range not reported

References 19