The vulnerability resides in the X.Org Server's gesture handling logic. A missing lifecycle management of gesture sprites in GestureBuildSprite() creates a use‑after‑free condition that an authenticated X client can trigger. This flaw can cause the X server to crash or, in the worst case, allow the attacker to execute arbitrary code within the server process.

Affected are the X.Org X Server (xorg‑x11‑server) up to version 21.1.24 and XWayland up to 24.1.13. Deployments using these components without the patch are vulnerable. Distributions that ship older releases should verify whether the gesture handling code is present and update accordingly.

The CVSS score of 5.3 indicates a medium severity and the EPSS score is unavailable, suggesting no publicly measured likelihood of exploitation. The vulnerability is not listed in CISA's KEV database, meaning no widespread exploit activity has been reported. The attack requires an authenticated X client, which typically corresponds to a user running a session on the affected system. Although full remote code execution is not guaranteed, the flaw could lead to a crash or potentially allow code execution, resulting in denial of service or loss of confidentiality.