An out-of-bounds read flaw was identified in the X.Org X server and Xwayland in the glXChangeDrawableAttributes function. The flaw occurs because a size validation check allows a client to request an invalid number of bytes, causing a read that extends beyond the bounds of the request buffer. A write path also exists but requires byte‑swapped clients, a mode that is disabled by default. The vulnerability falls under CWE‑125 and can lead to disclosure of interpreter or memory contents; if the write path were leveraged, it could enable further exploitation such as unauthorized memory modification.

The vulnerability affects Red Hat Enterprise Linux deployments running the X.Org X server on versions 6, 7, 8, 9, and 10. The affected packages are the standard Xorg‑x11‑server and Xwayland components shipped with RHEL.

The CVSS v3.1 score of 5.5 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation is currently documented. The primary attack vector is a locally or remotely connected X client capable of sending arbitrarily crafted GLX requests. Because X servers typically run with local user privileges, the risk profile is higher for administrators who allow untrusted clients or expose the X display over a network. Formal exploitation would require a crafted client, and no public exploit exists as of the data provided.