The flaw is a buffer overread in the CheckKeySyms routine, triggered by authenticated X clients that send specially crafted XKB SetMap requests with inconsistent key width and action count parameters. This misuse allows an attacker to read memory outside the intended bounds, leaking small amounts of sensitive data such as configuration or credential information. The vulnerability is classified as a buffer overread and overflow, identified as CWE-125 and CWE-126, and may also lead to a crash.

The vulnerability impacts the xorg-x11-server and xwayland packages. Specifically, any installation of X.Org X Server before version 21.1.25 and XWayland before 24.1.14 is affected. The flaw is triggered by the X Keyboard Extension and could be exploited by a local, authenticated user.

The CVSS score of 6.9 indicates moderate severity. Exploitation requires local, authenticated access to the X server; an attacker must run an X client that can communicate with the display. Because the EPSS score is not available and the flaw is not listed in the CISA KEV catalog, the likelihood of widespread exploitation remains low, though the vulnerability still permits sensitive information disclosure and potential local denial of service.