A heap buffer overflow originates in the CopyArea CPU‑to‑FBO path of the X.Org X server when size parameters are mis‑matched. An authenticated X client can craft a malicious CopyArea request that overruns a heap buffer, causing the X server to crash or, potentially, execute forged code within its process. Because the attacker must be able to send requests to the X server, the vulnerability is exercised from the client side.

The flaw impacts the X.Org X11 Server releases before 21.1.15 and the XWayland builds earlier than 24.1.14. Any Linux distribution or environment that includes an X server package or XWayland version older than these respective releases could be rendered vulnerable.

The CVSS score of 7.8 classifies this issue as high severity. The EPSS metric is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no public exploits have been identified yet. The expected attack vector is an authenticated X client that constructs a malicious CopyArea request. Successful exploitation would lead to application crash or, in the best‑case scenario, arbitrary code execution with the privileges of the X server process, enabling local privilege escalation or denial of service. Consequently, mitigation should be prioritized.