A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange in the X.org X server before 2.1.25 and XWayland before 24.1.14 can be used by authenticated X clients to crash the server or potentially execute code in the X server context. The flaw originates from an insufficient buffer size allocation for key name memory when adjusting the keycode range, leading to a heap-based overflow that threatens confidentiality, integrity, and availability.

The affected products are the Xorg X11 server before 2.1.25 and the XWayland before 24.1.14. Specific vendor and version details are not enumerated in the provided data, but the issue applies to Linux/Unix environments running the Xorg server or XWayland that support XKB functionality.

The CVSS score of 7.8 reflects a high risk for local attackers who can authenticate to the X server. With the EPSS score unavailable, the potential for exploitation remains uncertain, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a local authenticated client issuing XKB ChangeKeycodeRange requests, which can destabilize the X server or give the attacker code execution capabilities on the host system.