In X.Org X server 20.11 through 21.1.16, when a client application uses easystroke for…
Priority HIGH 67CWE-413Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
In X.Org X server 20.11 through 21.1.16, when a client application uses easystroke for mouse gestures, the main thread modifies various data structures used by the input thread without acquiring a lock, aka a race condition. In particular, AttachDevice in dix/devices.c does not acquire an input lock.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00341 27th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-49737
- 2026-10-03 Alias added: GHSA-3f26-j6r7-9q8v
References
Other 4
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1081338
- https://gitlab.freedesktop.org/xorg/xserver/-/issues/1260
- https://bugs.debian.org/cgi-bin/bugreport.cgi?att=1;bug=1081338;filename=dix-Hold-input-lock-for-AttachDevice.patch;msg=5
- https://gitlab.freedesktop.org/xorg/xserver/-/commit/dc7cb45482cea6ccec22d117ca0b489500b4d0a0
More x.org vulnerabilities
- TI-1999-00519 An X server's access control is disabled (e.g. CVSS 2.0HIGH 10.0
- TI-2021-11657 LookupCol.c in X.Org X through X11R7.7 and libX11 before 1.7.1 might allow remote… CVSS 3.1CRITICAL 9.8
- TI-2018-10465 An issue was discovered in libX11 through 1.6.5. CVSS 3.0CRITICAL 9.8
- TI-2004-00826 Multiple vulnerabilities in libXpm for 6.8.1 and earlier, as used in XFree86 and other… CVSS 2.0HIGH 10.0
- TI-2016-08240 Multiple integer overflows in libXpm before 3.5.12, when a program requests parsing XPM… CVSS 3.0CRITICAL 9.8
- TI-2018-10528 A flaw was found in xorg-x11-server before 1.20.3. CVSS 3.0MEDIUM 6.6
Sources
- CVE-2022-49737 · CVE Program
- CVE-2022-49737 · NVD
- FIRST EPSS
- GHSA-3f26-j6r7-9q8v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences