Use after free in xorg-x11-server
Priority MEDIUM 45CWE-416Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 13 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-416 and the CVSS impact.
Summary
A vulnerability was found in X.Org. This security flaw occurs because the handler for the ScreenSaverSetAttributes request may write to memory after it has been freed. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02556 85th percentileScored 2026-11-07
Fix Partial Red Hat: 9 advisoriesRed Hat: 13 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | xorg-x11-server | xorg-x11-server-1.20.4 | — | No fix listed | CNA |
- xorg-x11-server Vendor— Affected xorg-x11-server-1.20.4 Fixed in — No fix listed CNA
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:x.org:x_server:1.20.4:*:*:*:*:*:*:* | 1.20.4 | Vulnerable | x.org |
| cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* | 6.0 | Running on | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* | 7.0 | Running on | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Running on | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* | 9.0 | Running on | Red Hat |
| cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* | 36 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | 37 | Vulnerable | Fedoraproject |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
- cpe:2.3:a:x.org:x_server:1.20.4:*:*:*:*:*:*:* Versions 1.20.4 Vulnerable ·x.org
- cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Running on ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Running on ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Running on ·Red Hat
- cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
Remediation
Red Hat 9 advisories
- RHSA-2025:12751 Released 2025-08-04 · Red Hat rating Importanttigervnc security update
- Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION) tigervnc-1.1.0-25.el6_10.13, tigervnc-server-1.1.0-25.el6_10.13
- Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION) tigervnc-server-applet-1.1.0-25.el6_10.13, tigervnc-server-module-1.1.0-25.el6_10.13
- RHSA-2023:2805 Released 2023-05-16 · Red Hat rating Moderatexorg-x11-server-Xwayland security update
- Red Hat Enterprise Linux AppStream (v. 8) xorg-x11-server-Xwayland-21.1.3-10.el8
- RHSA-2023:2830 Released 2023-05-16 · Red Hat rating Moderatetigervnc security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) tigervnc-1.12.0-15.el8_8, tigervnc-icons-1.12.0-15.el8_8, tigervnc-license-1.12.0-15.el8_8 +4
Show 6 more Red Hat advisories
- RHSA-2023:2806 Released 2023-05-16 · Red Hat rating Moderatexorg-x11-server security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) xorg-x11-server-1.20.11-15.el8, xorg-x11-server-Xdmx-1.20.11-15.el8, xorg-x11-server-Xephyr-1.20.11-15.el8 +4
- Red Hat Enterprise Linux CRB (v. 8) xorg-x11-server-devel-1.20.11-15.el8, xorg-x11-server-source-1.20.11-15.el8
- RHSA-2023:2257 Released 2023-05-09 · Red Hat rating Moderatetigervnc security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 9) tigervnc-1.12.0-13.el9_2, tigervnc-icons-1.12.0-13.el9_2, tigervnc-license-1.12.0-13.el9_2 +4
- RHSA-2023:2249 Released 2023-05-09 · Red Hat rating Moderatexorg-x11-server-Xwayland security update
- Red Hat Enterprise Linux AppStream (v. 9) xorg-x11-server-Xwayland-21.1.3-7.el9
- RHSA-2023:2248 Released 2023-05-09 · Red Hat rating Moderatexorg-x11-server security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 9) xorg-x11-server-1.20.11-17.el9, xorg-x11-server-Xdmx-1.20.11-17.el9, xorg-x11-server-Xephyr-1.20.11-17.el9 +4
- Red Hat Enterprise Linux CRB (v. 9) xorg-x11-server-devel-1.20.11-17.el9, xorg-x11-server-source-1.20.11-17.el9
- RHSA-2023:0045 Released 2023-01-09 · Red Hat rating Importanttigervnc security update
- Red Hat Enterprise Linux Client (v. 7) tigervnc-1.8.0-23.el7_9, tigervnc-icons-1.8.0-23.el7_9, tigervnc-license-1.8.0-23.el7_9 +2
- Red Hat Enterprise Linux Client Optional (v. 7) tigervnc-server-applet-1.8.0-23.el7_9, tigervnc-server-module-1.8.0-23.el7_9
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) tigervnc-1.8.0-23.el7_9, tigervnc-icons-1.8.0-23.el7_9, tigervnc-server-1.8.0-23.el7_9 +2
- Red Hat Enterprise Linux Server (v. 7) tigervnc-1.8.0-23.el7_9, tigervnc-icons-1.8.0-23.el7_9, tigervnc-license-1.8.0-23.el7_9 +2
- Red Hat Enterprise Linux Server Optional (v. 7) tigervnc-server-applet-1.8.0-23.el7_9, tigervnc-server-module-1.8.0-23.el7_9
- Red Hat Enterprise Linux Workstation (v. 7) tigervnc-1.8.0-23.el7_9, tigervnc-icons-1.8.0-23.el7_9, tigervnc-license-1.8.0-23.el7_9 +2
- Red Hat Enterprise Linux Workstation Optional (v. 7) tigervnc-server-applet-1.8.0-23.el7_9, tigervnc-server-module-1.8.0-23.el7_9
- RHSA-2023:0046 Released 2023-01-09 · Red Hat rating Importantxorg-x11-server security update
- Red Hat Enterprise Linux Client (v. 7) xorg-x11-server-1.20.4-21.el7_9, xorg-x11-server-Xephyr-1.20.4-21.el7_9, xorg-x11-server-Xorg-1.20.4-21.el7_9 +1
- Red Hat Enterprise Linux Client Optional (v. 7) xorg-x11-server-Xdmx-1.20.4-21.el7_9, xorg-x11-server-Xnest-1.20.4-21.el7_9, xorg-x11-server-Xvfb-1.20.4-21.el7_9 +3
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) xorg-x11-server-1.20.4-21.el7_9, xorg-x11-server-Xdmx-1.20.4-21.el7_9, xorg-x11-server-Xephyr-1.20.4-21.el7_9 +7
- Red Hat Enterprise Linux Server (v. 7) xorg-x11-server-1.20.4-21.el7_9, xorg-x11-server-Xephyr-1.20.4-21.el7_9, xorg-x11-server-Xorg-1.20.4-21.el7_9 +1
- Red Hat Enterprise Linux Server Optional (v. 7) xorg-x11-server-Xdmx-1.20.4-21.el7_9, xorg-x11-server-Xnest-1.20.4-21.el7_9, xorg-x11-server-Xvfb-1.20.4-21.el7_9 +4
- Red Hat Enterprise Linux Workstation (v. 7) xorg-x11-server-1.20.4-21.el7_9, xorg-x11-server-Xephyr-1.20.4-21.el7_9, xorg-x11-server-Xorg-1.20.4-21.el7_9 +1
- Red Hat Enterprise Linux Workstation Optional (v. 7) xorg-x11-server-Xdmx-1.20.4-21.el7_9, xorg-x11-server-Xnest-1.20.4-21.el7_9, xorg-x11-server-Xvfb-1.20.4-21.el7_9 +3
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
xorg-x11-server — FEDORA-2022-721a78b7e5
6 records Highest priority Priority MEDIUM 5 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2022-22885 Out-of-bounds write in xorg-x11-serverPriority MEDIUM 45
- TI-2022-22884 Out-of-bounds write in xorg-x11-serverPriority MEDIUM 45
- TI-2022-22888 Out-of-bounds read in xorg-x11-serverPriority MEDIUM 43
- Advisory ·
xorg-x11-server — FEDORA-2022-c3a65f7c65
6 records Highest priority Priority MEDIUM 5 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2022-22885 Out-of-bounds write in xorg-x11-serverPriority MEDIUM 45
- TI-2022-22884 Out-of-bounds write in xorg-x11-serverPriority MEDIUM 45
- TI-2022-22888 Out-of-bounds read in xorg-x11-serverPriority MEDIUM 43
Show 2 more groups
- Advisory ·
xorg-x11-server — FEDORA-2022-dd3eb7e0a8
6 records Highest priority Priority MEDIUM 5 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2022-22885 Out-of-bounds write in xorg-x11-serverPriority MEDIUM 45
- TI-2022-22884 Out-of-bounds write in xorg-x11-serverPriority MEDIUM 45
- TI-2022-22888 Out-of-bounds read in xorg-x11-serverPriority MEDIUM 43
- Advisory ·
xorg-x11-server — DSA-5304
6 records Highest priority Priority MEDIUM 5 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2022-22885 Out-of-bounds write in xorg-x11-serverPriority MEDIUM 45
- TI-2022-22884 Out-of-bounds write in xorg-x11-serverPriority MEDIUM 45
- TI-2022-22888 Out-of-bounds read in xorg-x11-serverPriority MEDIUM 43
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2023:2805, RHSA-2023:2806, RHSA-2023:2830 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2023:2248, RHSA-2023:2249, RHSA-2023:2257 |
| Red Hat Enterprise Linux CRB (v. 8) | Fixed | RHSA-2023:2806 |
| Red Hat Enterprise Linux CRB (v. 9) | Fixed | RHSA-2023:2248 |
| Red Hat Enterprise Linux Client (v. 7) | Fixed | RHSA-2023:0045, RHSA-2023:0046 |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2023:0045, RHSA-2023:0046 |
| Red Hat Enterprise Linux ComputeNode Optional (v. 7) | Fixed | RHSA-2023:0045, RHSA-2023:0046 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2023:0045, RHSA-2023:0046 |
| Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION) | Fixed | RHSA-2025:12751 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2023:0045, RHSA-2023:0046 |
| Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION) | Fixed | RHSA-2025:12751 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2023:0045, RHSA-2023:0046 |
| Red Hat Enterprise Linux Workstation Optional (v. 7) | Fixed | RHSA-2023:0045, RHSA-2023:0046 |
Timeline
- 2026-10-02 Threatist record created from CVE-2022-46343
- 2026-10-03 Alias added: GHSA-cfjv-73gp-92j6
References
Sources
- CVE-2022-46343 · CVE Program
- CVE-2022-46343 · NVD
- FIRST EPSS
- GHSA-cfjv-73gp-92j6 · GitHub Advisory Database · CC BY 4.0
- CVE-2022-46343 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences