The vulnerability lies in the X.Org X server’s X Keyboard extension where an unsigned short overflow can occur in the XkbSetCompatMap() function due to improper bounds checking. When an attacker sends specially crafted input, the overflow can lead to memory corruption or a crash, potentially compromising the integrity and confidentiality of the system. This weakness is identified as a classic integer overflow (CWE-190).

Red Hat Enterprise Linux 6 through 10, including all extended lifecycle, advanced, and updates support channels, as well as the X.Org Xwayland implementation. The Red Hat errata catalog lists multiple updates for RHEL 6, 7, 8, 9, 10 and Xwayland to address this flaw.

The vulnerability has a CVSS score of 7.3, indicating high severity, but the EPSS score is less than 1%, suggesting a low probability of exploitation at this time. It is not listed in CISA’s KEV. A likely attack vector is a remote attacker able to send forged XKB protocol data to a running X server, causing overflow and memory corruption. The exploit would require the attacker to be able to connect to the X server, which typically means a trusted local or remote client on the X network. The lack of a public workaround means that only patching mitigates the risk.