Technical impact
An overflow occurs when negative sizes are supplied to ProcXvShmPutImage requests. The flaw allows authenticated local X clients to cause the X server to crash or run arbitrary code at the server’s privilege level. The vulnerability is classified as immunity to negative size handling errors and is identified as CWE‑191.
Affected Systems
The issue exists in the X.Org X Server (xorg‑x11‑server) prior to release 21.1.26 and in XWayland prior to 24.1.15. Affected installations running either version without the patch are susceptible.
Risk and Exploitability
The CVSS score of 7.8 indicates a high severity, and the vulnerability is exploitable by any local user with access to the X session. The EPSS score is not available, and the flaw is not listed in CISA’s KEV catalog, suggesting a lower yet non‑negligible exploitation probability. Attackers must be authenticated to the X server, but once authenticated they can trigger the overflow to crash the server or execute code. Upgrading to the fixed versions removes the exploit surface.
