A stack‑based buffer overflow exists in the XKB library function XkbVModMaskText, which copies virtual modifier names into a fixed‑size stack buffer without validating the input length. The flaw allows an attacker to overflow the buffer, corrupt memory, and potentially execute arbitrary code or crash the X server. The vulnerability is classified under CWE‑121 (Stack Based Buffer Overflow) and CWE‑787 (Out‑of‑Bounds Write).

The flaw affects Red Hat Enterprise Linux 6, 7, 8, 9, and 10 in their standard and extended update streams, as well as the underlying X.Org Server and XWayland packages delivered with those distributions. All listed RHEL releases that include the vulnerable XKB code are impacted.

The assessed CVSS score of 7.8 reflects a high‑severity issue. The EPSS score of less than 1 % indicates a low probability of exploitation in observed CVE usage, and the vulnerability is not currently listed in the CISA KEV catalog. Based on the description, the exploitation likely requires local interaction with a running X server or remote X client connections; however, concrete attack paths are not detailed in the advisory. Administrators should assume the potential for remote code execution if the X server is exposed to untrusted networks, and the risk remains high until the security updates are applied.