This vulnerability is a use‑after‑free in the SyncChangeCounter function of the X.Org X server and Xwayland. A client that creates multiple SyncCounters can trigger the flaw when a second client deletes those counters while they are still being changed. The flaw can cause the X server to crash or, if the server is running with root privileges, can be used to elevate privileges of the malicious client. The primary impact is privilege escalation when the X server runs as root, and potential denial of service through a crash.

Affected users are those running Red Hat Enterprise Linux 6 through 10, as these distributions ship the vulnerable X.Org X server and Xwayland. The flaw applies to all versions of these distributions that include the affected packages before the latest security update.

The CVSS score of 7.8 indicates a high‑severity flaw. The EPSS score is not available, so the current exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog, but the flaw can be triggered by any client that can open a connection to the X server or Xwayland. If exploited, an attacker could crash the server or gain root privileges on systems where the X server runs with elevated rights. The primary attack vector is through a forged X client session, either local or networked, that exercises the counter functionality.