Read the docs
TI-2024-14548 Aliases CVE-2024-21886GHSA-vx3h-cj8w-2h2c

Xorg-x11-server: heap buffer overflow in disabledevice

Priority MEDIUM 43CWE-122Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 23 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-122 and the CVSS impact.

Summary

A heap buffer overflow flaw was found in the DisableDevice function in the X.Org server. This issue may lead to an application crash or, in some circumstances, remote code execution in SSH X11 forwarding environments.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0142 72nd percentileScored 2026-11-07
Fix Partial Red Hat: 15 advisoriesRed Hat: 23 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—xorg-server1.21.1.7—No fix listedCNA
Red HatRed Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION—1.1.0-25.el6_10.13Patch availableCNA
Red HatRed Hat Enterprise Linux 7—1.20.4-27.el7_9Patch availableCNA
Red HatRed Hat Enterprise Linux 7—1.8.0-31.el7_9Patch availableCNA
Red HatRed Hat Enterprise Linux 8—1.13.1-2.el8_9.7Patch availableCNA
Red HatRed Hat Enterprise Linux 8—1.20.11-22.el8Patch availableCNA
Red HatRed Hat Enterprise Linux 8—21.1.3-15.el8Patch availableCNA
Red HatRed Hat Enterprise Linux 8.2 Advanced Update Support—1.9.0-15.el8_2.9Patch availableCNA
Red HatRed Hat Enterprise Linux 8.2 Telecommunications Update Service—1.9.0-15.el8_2.9Patch availableCNA
Red HatRed Hat Enterprise Linux 8.2 Update Services for SAP Solutions—1.9.0-15.el8_2.9Patch availableCNA
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support—1.11.0-8.el8_4.8Patch availableCNA
Red HatRed Hat Enterprise Linux 8.4 Telecommunications Update Service—1.11.0-8.el8_4.8Patch availableCNA
Red HatRed Hat Enterprise Linux 8.4 Update Services for SAP Solutions—1.11.0-8.el8_4.8Patch availableCNA
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support—1.12.0-6.el8_6.9Patch availableCNA
Red HatRed Hat Enterprise Linux 8.8 Extended Update Support—1.12.0-15.el8_8.7Patch availableCNA
Red HatRed Hat Enterprise Linux 9—1.13.1-3.el9_3.6Patch availableCNA
Red HatRed Hat Enterprise Linux 9—1.20.11-24.el9Patch availableCNA
Red HatRed Hat Enterprise Linux 9—22.1.9-5.el9Patch availableCNA
Red HatRed Hat Enterprise Linux 9.0 Extended Update Support—1.11.0-22.el9_0.8Patch availableCNA
Red HatRed Hat Enterprise Linux 9.2 Extended Update Support—1.12.0-14.el9_2.5Patch availableCNA
Red HatRed Hat Enterprise Linux 6——No fix listedCNA
  • xorg-server Vendor— Affected 1.21.1.7 Fixed in — No fix listed CNA
  • Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION VendorRed Hat Affected — Fixed in 1.1.0-25.el6_10.13 Patch available CNA
  • Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in 1.20.4-27.el7_9 Patch available CNA
  • Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in 1.8.0-31.el7_9 Patch available CNA
  • Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 1.13.1-2.el8_9.7 Patch available CNA
  • Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 1.20.11-22.el8 Patch available CNA
  • Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 21.1.3-15.el8 Patch available CNA
  • Red Hat Enterprise Linux 8.2 Advanced Update Support VendorRed Hat Affected — Fixed in 1.9.0-15.el8_2.9 Patch available CNA
  • Red Hat Enterprise Linux 8.2 Telecommunications Update Service VendorRed Hat Affected — Fixed in 1.9.0-15.el8_2.9 Patch available CNA
  • Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 1.9.0-15.el8_2.9 Patch available CNA
  • Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 1.11.0-8.el8_4.8 Patch available CNA
  • Red Hat Enterprise Linux 8.4 Telecommunications Update Service VendorRed Hat Affected — Fixed in 1.11.0-8.el8_4.8 Patch available CNA
  • Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 1.11.0-8.el8_4.8 Patch available CNA
  • Red Hat Enterprise Linux 8.6 Extended Update Support VendorRed Hat Affected — Fixed in 1.12.0-6.el8_6.9 Patch available CNA
  • Red Hat Enterprise Linux 8.8 Extended Update Support VendorRed Hat Affected — Fixed in 1.12.0-15.el8_8.7 Patch available CNA
  • Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 1.13.1-3.el9_3.6 Patch available CNA
  • Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 1.20.11-24.el9 Patch available CNA
  • Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 22.1.9-5.el9 Patch available CNA
  • Red Hat Enterprise Linux 9.0 Extended Update Support VendorRed Hat Affected — Fixed in 1.11.0-22.el9_0.8 Patch available CNA
  • Red Hat Enterprise Linux 9.2 Extended Update Support VendorRed Hat Affected — Fixed in 1.12.0-14.el9_2.5 Patch available CNA
  • Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — No fix listed CNA

CPE names CNA · 19

CPEVersionsRoleVendor
cpe:/o:redhat:rhel_els:66—Red Hat
cpe:/o:redhat:enterprise_linux:7::client7—Red Hat
cpe:/o:redhat:enterprise_linux:7::computenode7—Red Hat
cpe:/o:redhat:enterprise_linux:7::server7—Red Hat
cpe:/o:redhat:enterprise_linux:7::workstation7—Red Hat
cpe:/a:redhat:enterprise_linux:8::appstream8—Red Hat
cpe:/a:redhat:enterprise_linux:8::crb8—Red Hat
cpe:/a:redhat:rhel_aus:8.2::appstream8.2—Red Hat
cpe:/a:redhat:rhel_e4s:8.2::appstream8.2—Red Hat
cpe:/a:redhat:rhel_tus:8.2::appstream8.2—Red Hat
  • cpe:/o:redhat:rhel_els:6 Versions 6 — ·Red Hat
  • cpe:/o:redhat:enterprise_linux:7::client Versions 7 — ·Red Hat
  • cpe:/o:redhat:enterprise_linux:7::computenode Versions 7 — ·Red Hat
  • cpe:/o:redhat:enterprise_linux:7::server Versions 7 — ·Red Hat
  • cpe:/o:redhat:enterprise_linux:7::workstation Versions 7 — ·Red Hat
  • cpe:/a:redhat:enterprise_linux:8::appstream Versions 8 — ·Red Hat
  • cpe:/a:redhat:enterprise_linux:8::crb Versions 8 — ·Red Hat
  • cpe:/a:redhat:rhel_aus:8.2::appstream Versions 8.2 — ·Red Hat
  • cpe:/a:redhat:rhel_e4s:8.2::appstream Versions 8.2 — ·Red Hat
  • cpe:/a:redhat:rhel_tus:8.2::appstream Versions 8.2 — ·Red Hat
Show 9 more CPE
CPEVersionsRoleVendor
cpe:/a:redhat:rhel_aus:8.4::appstream8.4—Red Hat
cpe:/a:redhat:rhel_e4s:8.4::appstream8.4—Red Hat
cpe:/a:redhat:rhel_tus:8.4::appstream8.4—Red Hat
cpe:/a:redhat:rhel_eus:8.6::appstream8.6—Red Hat
cpe:/a:redhat:rhel_eus:8.8::appstream8.8—Red Hat
cpe:/a:redhat:enterprise_linux:9::appstream9—Red Hat
cpe:/a:redhat:enterprise_linux:9::crb9—Red Hat
cpe:/a:redhat:rhel_eus:9.0::appstream9.0—Red Hat
cpe:/a:redhat:rhel_eus:9.2::appstream9.2—Red Hat
  • cpe:/a:redhat:rhel_aus:8.4::appstream Versions 8.4 — ·Red Hat
  • cpe:/a:redhat:rhel_e4s:8.4::appstream Versions 8.4 — ·Red Hat
  • cpe:/a:redhat:rhel_tus:8.4::appstream Versions 8.4 — ·Red Hat
  • cpe:/a:redhat:rhel_eus:8.6::appstream Versions 8.6 — ·Red Hat
  • cpe:/a:redhat:rhel_eus:8.8::appstream Versions 8.8 — ·Red Hat
  • cpe:/a:redhat:enterprise_linux:9::appstream Versions 9 — ·Red Hat
  • cpe:/a:redhat:enterprise_linux:9::crb Versions 9 — ·Red Hat
  • cpe:/a:redhat:rhel_eus:9.0::appstream Versions 9.0 — ·Red Hat
  • cpe:/a:redhat:rhel_eus:9.2::appstream Versions 9.2 — ·Red Hat

Remediation

Red Hat 15 advisories

  • RHSA-2025:12751 Released 2025-08-04 · Red Hat rating Important
    tigervnc security update
    • Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION) tigervnc-1.1.0-25.el6_10.13, tigervnc-server-1.1.0-25.el6_10.13
    • Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION) tigervnc-server-applet-1.1.0-25.el6_10.13, tigervnc-server-module-1.1.0-25.el6_10.13
  • RHSA-2024:2996 Released 2024-05-22 · Red Hat rating Moderate
    xorg-x11-server-Xwayland security update
    • Red Hat Enterprise Linux AppStream (v. 8) xorg-x11-server-Xwayland-21.1.3-15.el8
  • RHSA-2024:2995 Released 2024-05-22 · Red Hat rating Moderate
    xorg-x11-server security update
    • Red Hat Enterprise Linux AppStream (v. 8) xorg-x11-server-1.20.11-22.el8, xorg-x11-server-Xdmx-1.20.11-22.el8, xorg-x11-server-Xephyr-1.20.11-22.el8 +4
    • Red Hat Enterprise Linux CRB (v. 8) xorg-x11-server-devel-1.20.11-22.el8, xorg-x11-server-source-1.20.11-22.el8
Show 12 more Red Hat advisories
  • RHSA-2024:2169 Released 2024-04-30 · Red Hat rating Moderate
    xorg-x11-server security update
    • Red Hat Enterprise Linux AppStream (v. 9) xorg-x11-server-1.20.11-24.el9, xorg-x11-server-Xdmx-1.20.11-24.el9, xorg-x11-server-Xephyr-1.20.11-24.el9 +4
    • Red Hat Enterprise Linux CRB (v. 9) xorg-x11-server-devel-1.20.11-24.el9, xorg-x11-server-source-1.20.11-24.el9
  • RHSA-2024:2170 Released 2024-04-30 · Red Hat rating Moderate
    xorg-x11-server-Xwayland security update
    • Red Hat Enterprise Linux AppStream (v. 9) xorg-x11-server-Xwayland-22.1.9-5.el9
  • RHSA-2024:0629 Released 2024-01-31 · Red Hat rating Important
    tigervnc security update
    • Red Hat Enterprise Linux Client (v. 7) tigervnc-1.8.0-31.el7_9, tigervnc-icons-1.8.0-31.el7_9, tigervnc-license-1.8.0-31.el7_9 +2
    • Red Hat Enterprise Linux Client Optional (v. 7) tigervnc-server-applet-1.8.0-31.el7_9, tigervnc-server-module-1.8.0-31.el7_9
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) tigervnc-1.8.0-31.el7_9, tigervnc-icons-1.8.0-31.el7_9, tigervnc-server-1.8.0-31.el7_9 +2
    • Red Hat Enterprise Linux Server (v. 7) tigervnc-1.8.0-31.el7_9, tigervnc-icons-1.8.0-31.el7_9, tigervnc-license-1.8.0-31.el7_9 +2
    • Red Hat Enterprise Linux Server Optional (v. 7) tigervnc-server-applet-1.8.0-31.el7_9, tigervnc-server-module-1.8.0-31.el7_9
    • Red Hat Enterprise Linux Workstation (v. 7) tigervnc-1.8.0-31.el7_9, tigervnc-icons-1.8.0-31.el7_9, tigervnc-license-1.8.0-31.el7_9 +2
    • Red Hat Enterprise Linux Workstation Optional (v. 7) tigervnc-server-applet-1.8.0-31.el7_9, tigervnc-server-module-1.8.0-31.el7_9
  • RHSA-2024:0626 Released 2024-01-31 · Red Hat rating Important
    tigervnc security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) tigervnc-1.12.0-14.el9_2.5, tigervnc-icons-1.12.0-14.el9_2.5, tigervnc-license-1.12.0-14.el9_2.5 +4
  • RHSA-2024:0617 Released 2024-01-31 · Red Hat rating Important
    tigervnc security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) tigervnc-1.9.0-15.el8_2.9, tigervnc-icons-1.9.0-15.el8_2.9, tigervnc-license-1.9.0-15.el8_2.9 +4
    • Red Hat Enterprise Linux AppStream E4S (v. 8.2) tigervnc-1.9.0-15.el8_2.9, tigervnc-icons-1.9.0-15.el8_2.9, tigervnc-license-1.9.0-15.el8_2.9 +4
    • Red Hat Enterprise Linux AppStream TUS (v. 8.2) tigervnc-1.9.0-15.el8_2.9, tigervnc-icons-1.9.0-15.el8_2.9, tigervnc-license-1.9.0-15.el8_2.9 +4
  • RHSA-2024:0621 Released 2024-01-30 · Red Hat rating Important
    tigervnc security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.6) tigervnc-1.12.0-6.el8_6.9, tigervnc-icons-1.12.0-6.el8_6.9, tigervnc-license-1.12.0-6.el8_6.9 +4
  • RHSA-2024:0614 Released 2024-01-30 · Red Hat rating Important
    tigervnc security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.0) tigervnc-1.11.0-22.el9_0.8, tigervnc-icons-1.11.0-22.el9_0.8, tigervnc-license-1.11.0-22.el9_0.8 +4
  • RHSA-2024:0607 Released 2024-01-30 · Red Hat rating Important
    tigervnc security update
    • Red Hat Enterprise Linux AppStream (v. 8) tigervnc-1.13.1-2.el8_9.7, tigervnc-icons-1.13.1-2.el8_9.7, tigervnc-license-1.13.1-2.el8_9.7 +4
  • RHSA-2024:0597 Released 2024-01-30 · Red Hat rating Important
    tigervnc security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.8) tigervnc-1.12.0-15.el8_8.7, tigervnc-icons-1.12.0-15.el8_8.7, tigervnc-license-1.12.0-15.el8_8.7 +4
  • RHSA-2024:0558 Released 2024-01-30 · Red Hat rating Important
    tigervnc security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) tigervnc-1.11.0-8.el8_4.8, tigervnc-icons-1.11.0-8.el8_4.8, tigervnc-license-1.11.0-8.el8_4.8 +4
    • Red Hat Enterprise Linux AppStream E4S (v.8.4) tigervnc-1.11.0-8.el8_4.8, tigervnc-icons-1.11.0-8.el8_4.8, tigervnc-license-1.11.0-8.el8_4.8 +4
    • Red Hat Enterprise Linux AppStream TUS (v.8.4) tigervnc-1.11.0-8.el8_4.8, tigervnc-icons-1.11.0-8.el8_4.8, tigervnc-license-1.11.0-8.el8_4.8 +4
  • RHSA-2024:0557 Released 2024-01-30 · Red Hat rating Important
    tigervnc security update
    • Red Hat Enterprise Linux AppStream (v. 9) tigervnc-1.13.1-3.el9_3.6, tigervnc-icons-1.13.1-3.el9_3.6, tigervnc-license-1.13.1-3.el9_3.6 +4
  • RHSA-2024:0320 Released 2024-01-22 · Red Hat rating Important
    xorg-x11-server security update
    • Red Hat Enterprise Linux Client (v. 7) xorg-x11-server-1.20.4-27.el7_9, xorg-x11-server-Xephyr-1.20.4-27.el7_9, xorg-x11-server-Xorg-1.20.4-27.el7_9 +1
    • Red Hat Enterprise Linux Client Optional (v. 7) xorg-x11-server-Xdmx-1.20.4-27.el7_9, xorg-x11-server-Xnest-1.20.4-27.el7_9, xorg-x11-server-Xvfb-1.20.4-27.el7_9 +3
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) xorg-x11-server-1.20.4-27.el7_9, xorg-x11-server-Xdmx-1.20.4-27.el7_9, xorg-x11-server-Xephyr-1.20.4-27.el7_9 +7
    • Red Hat Enterprise Linux Server (v. 7) xorg-x11-server-1.20.4-27.el7_9, xorg-x11-server-Xephyr-1.20.4-27.el7_9, xorg-x11-server-Xorg-1.20.4-27.el7_9 +1
    • Red Hat Enterprise Linux Server Optional (v. 7) xorg-x11-server-Xdmx-1.20.4-27.el7_9, xorg-x11-server-Xnest-1.20.4-27.el7_9, xorg-x11-server-Xvfb-1.20.4-27.el7_9 +4
    • Red Hat Enterprise Linux Workstation (v. 7) xorg-x11-server-1.20.4-27.el7_9, xorg-x11-server-Xephyr-1.20.4-27.el7_9, xorg-x11-server-Xorg-1.20.4-27.el7_9 +1
    • Red Hat Enterprise Linux Workstation Optional (v. 7) xorg-x11-server-Xdmx-1.20.4-27.el7_9, xorg-x11-server-Xnest-1.20.4-27.el7_9, xorg-x11-server-Xvfb-1.20.4-27.el7_9 +3

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2024:0607, RHSA-2024:2995, RHSA-2024:2996
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2024:0557, RHSA-2024:2169, RHSA-2024:2170
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2024:0617
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2024:0558
Red Hat Enterprise Linux AppStream E4S (v. 8.2)Fixed RHSA-2024:0617
Red Hat Enterprise Linux AppStream E4S (v.8.4)Fixed RHSA-2024:0558
Red Hat Enterprise Linux AppStream EUS (v.8.6)Fixed RHSA-2024:0621
Red Hat Enterprise Linux AppStream EUS (v.8.8)Fixed RHSA-2024:0597
Red Hat Enterprise Linux AppStream EUS (v.9.0)Fixed RHSA-2024:0614
Red Hat Enterprise Linux AppStream EUS (v.9.2)Fixed RHSA-2024:0626
Red Hat Enterprise Linux AppStream TUS (v. 8.2)Fixed RHSA-2024:0617
Red Hat Enterprise Linux AppStream TUS (v.8.4)Fixed RHSA-2024:0558
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2024:2995
Red Hat Enterprise Linux CRB (v. 9)Fixed RHSA-2024:2169
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2024:0320, RHSA-2024:0629
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2024:0320, RHSA-2024:0629
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2024:0320, RHSA-2024:0629
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2024:0320, RHSA-2024:0629
Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION)Fixed RHSA-2025:12751
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2024:0320, RHSA-2024:0629
Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION)Fixed RHSA-2025:12751
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2024:0320, RHSA-2024:0629
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2024:0320, RHSA-2024:0629

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-21886
  2. 2026-10-03 Alias added: GHSA-vx3h-cj8w-2h2c

References

  • TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
See all 7413 →

Sources