The vulnerability is an integer truncation in the XkbResizeKeyType() function of the Xorg X server and XWayland. Versions before 21.1.25 for the Xorg X11 server and before 24.1.14 for XWayland are affected. The truncation causes the server to allocate a buffer smaller than required when resizing key types, enabling an authenticated local client to send specially crafted XKB requests that overflow the heap. This heap buffer overflow can lead to an arbitrary memory overwrite, potentially crashing the X server or allowing the attacker to execute arbitrary code on the host.

The flaw affects the xorg-x11-server and xwayland binaries. Vulnerable versions are those released before 21.1.25 for the Xorg X11 server and before 24.1.14 for XWayland. The attack requires a locally authenticated client that communicates with the X server on the same machine.

The CVSS score of 7.8 signals a high risk level. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a local authenticated client, which limits widespread exploitation. An attacker with local access can trigger the heap overflow to cause a crash or potentially execute arbitrary code, resulting in denial of service or potential local privilege escalation. Defensive actions include applying the vendor patch when available or disabling the XKB extension to eliminate the vulnerable code paths.