A heap buffer overflow is caused when an XIPassiveUngrabDevice request contains an out‑of‑range modifier value. The flaw exists in the X.Org X11 server prior to version 21.1.15 and in XWayland prior to 24.1.14. An authenticated X client that can send the malformed request can force the server to write beyond the bounds of a heap buffer (CWE‑122) and corrupt adjacent memory (CWE‑787). This memory corruption can lead to a denial‑of‑service by crashing the X server, and if the attacker can control the contents of the overflow, it may also enable code execution within the X server context.

The vulnerability affects the X.Org X11 server and XWayland. Versions before 21.1.15 of the X11 server and before 24.1.14 of XWayland are impacted. Any installation of these components that has not been patched is susceptible to the flaw.

The CVSS score of 7.8 indicates a high severity for local attacks that require authentication to the X server. Because the EPSS score is not provided, the current likelihood of exploitation is unknown. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is local: an authenticated user or a malicious process that can communicate with the X server can craft the exploit payload and trigger the out‑of‑bounds write.