An out-of-bounds write flaw occurs in X.Org and XWayland when the function GetBarrierDevice searches for a pointer device. If no matching device ID is found, the code returns the last element in the device list instead of NULL, allowing the program to read or write beyond allocated memory. This memory corruption can result in data loss, process crashes, or in severe cases, arbitrary code execution as it violates integrity and confidentiality.

The vulnerability affects multiple Red Hat Enterprise Linux releases, including 6, 7, 8, 9, 10 and all associated extended and specialized update channels. It also impacts the TigerVNC and X.Org packages distributed under these operating systems. No specific package versions are listed, so all currently deployed instances of X.Org/XWayland are potentially exposed.

The CVSS score of 7.8 indicates significant risk with a medium-to-high impact. The EPSS score of less than 1% suggests that exploitation attempts are expected to be rare at the time of analysis. The flaw is not currently listed in the CISA KEV catalog. While the description does not specify an attack vector, the likely vector is local via a malicious X client or remote if XWayland is exposed over a network. The concise wording given in the CVE record is insufficient to determine whether remote exploitation is feasible, so the risk is assessed based on local privilege escalation potential.