Read the docs
TI-2023-23476 Aliases CVE-2023-43785GHSA-9368-fgh5-gh2f

Libx11: out-of-bounds memory access in _xkbreadkeysyms()

Priority LOW 30CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 2 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-125 and the CVSS impact.

Summary

A vulnerability was found in libX11 due to a boundary condition within the _XkbReadKeySyms() function. This flaw allows a local user to trigger an out-of-bounds read error and read the contents of memory on the system.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00669 52nd percentileScored 2026-11-07
Fix Partial libX11: 1.8.7Red Hat: 2 advisoriesRed Hat: 2 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—libX11before 1.8.71.8.7Patch availableCNA
Red HatRed Hat Enterprise Linux 8—1.6.8-8.el8Patch availableCNA
Red HatRed Hat Enterprise Linux 9—1.7.0-9.el9Patch availableCNA
Red HatRed Hat Enterprise Linux 6——No fix listedCNA
Red HatRed Hat Enterprise Linux 7——No fix listedCNA
  • libX11 Vendor— Affected before 1.8.7 Fixed in 1.8.7 Patch available CNA
  • Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 1.6.8-8.el8 Patch available CNA
  • Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 1.7.0-9.el9 Patch available CNA
  • Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — No fix listed CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:x.org:libx11:*:*:*:*:*:*:*:*before 1.8.7Vulnerablex.org
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*9.0VulnerableRed Hat
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*38VulnerableFedoraproject
  • cpe:2.3:a:x.org:libx11:*:*:*:*:*:*:*:* Versions before 1.8.7 Vulnerable ·x.org
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
  • cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject

Remediation

  • Fix · CNA libX11 Fixed in 1.8.7

Red Hat 2 advisories

  • RHSA-2024:2973 Released 2024-05-22 · Red Hat rating Moderate
    libX11 security update
    • Red Hat Enterprise Linux AppStream (v. 8) libX11-1.6.8-8.el8, libX11-common-1.6.8-8.el8, libX11-devel-1.6.8-8.el8 +1
  • RHSA-2024:2145 Released 2024-04-30 · Red Hat rating Moderate
    libX11 security update
    • Red Hat Enterprise Linux AppStream (v. 9) libX11-1.7.0-9.el9, libX11-common-1.7.0-9.el9, libX11-devel-1.7.0-9.el9 +1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 and 2 more products — RHSA-2024:2145

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2023-23478 Libx11: integer overflow in xcreateimage() leading to a heap overflowPriority LOW 37
    • TI-2023-23477 Libx11: stack exhaustion from infinite recursion in putsubimage()Priority LOW 25
    Show all 3 records → Advisory →
  • Advisory ·

    Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 and 2 more products — RHSA-2024:2973

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2023-23478 Libx11: integer overflow in xcreateimage() leading to a heap overflowPriority LOW 37
    • TI-2023-23477 Libx11: stack exhaustion from infinite recursion in putsubimage()Priority LOW 25
    Show all 3 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2024:2973
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2024:2145

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-43785
  2. 2026-10-03 Alias added: GHSA-9368-fgh5-gh2f
  3. 2026-10-04 EPSS moved to the 50th–90th percentile

References

Advisory 4

  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-10530 Code injection in [UNKNOWN] RichFaces KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-23530 Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf… KEVCVSS 3.1CRITICAL 9.3
  • TI-2021-17490 mod_proxy SSRF KEVCVSS 3.1CRITICAL 9.0
See all 1955 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences