A local, unprivileged attacker on a Linux client can hijack X11 forwarding connections by pre‑binding the preferred abstract X socket name. The attacker does not need root privileges, and the exploitation can reveal sensitive window contents and typed input. The attack may also permit some manipulation of the forwarded session. This flaw does not require network access; it attacks confidentiality of traffic transmitted over an otherwise encrypted SSH connection.

The vulnerability affects Red Hat Enterprise Linux releases 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4 via their OpenSSH client implementations. The flaw applies to any system where OpenSSH client X11 forwarding is enabled.

The CVSS score is 5, indicating medium severity. The EPSS score is unavailable, and the vulnerability is not on the CISA KEV list. Attack requires a local user to have X11 forwarding enabled and to be able to pre‑bind an abstract UNIX‑domain socket. Because the exploit is local and does not require elevated privileges, the attack vector is weaker than remote exploits but still poses a significant risk if X11 forwarding is routinely used.