xorg-x11-server-common (AlmaLinux:8) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the AlmaLinux:8 package xorg-x11-server-common, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (49)

• CVE-2022-46343 — CVSS 8.8 (high): A vulnerability was found in X.Org. This security flaw occurs because the handler for the ScreenSaverSetAttributes request may write to…
• CVE-2022-46344 — CVSS 8.8 (high): A vulnerability was found in X.Org. This security flaw occurs because the handler for the XIChangeProperty request has a length-validation…
• CVE-2022-46340 — CVSS 8.8 (high): A vulnerability was found in X.Org. This security flaw occurs becuase the swap handler for the XTestFakeInput request of the XTest…
• CVE-2022-46341 — CVSS 8.8 (high): A vulnerability was found in X.Org. This security flaw occurs because the handler for the XIPassiveUngrab request accesses out-of-bounds…
• CVE-2022-46342 — CVSS 8.8 (high): A vulnerability was found in X.Org. This security flaw occurs because the handler for the XvdiSelectVideoNotify request may write to memory…
• CVE-2022-2320 — CVSS 7.8 (high): A flaw was found in the Xorg-x11-server. The specific flaw exists within the handling of ProcXkbSetDeviceInfo requests. The issue results…
• CVE-2022-4283 — CVSS 7.8 (high): A vulnerability was found in X.Org. This security flaw occurs because the XkbCopyNames function left a dangling pointer to freed memory…
• CVE-2026-50264 — CVSS 7.8 (high): An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat. A client that requests…
• CVE-2021-4009 — CVSS 7.8 (high): A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in the…
• CVE-2021-4010 — CVSS 7.8 (high): A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in the…
• CVE-2021-4011 — CVSS 7.8 (high): A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in the…
• CVE-2022-2319 — CVSS 7.8 (high): A flaw was found in the Xorg-x11-server. An out-of-bounds access issue can occur in the ProcXkbSetGeometry function due to improper…
• CVE-2024-0409 — CVSS 7.8 (high): A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the…
• CVE-2024-21885 — CVSS 7.8 (high): A flaw was found in X.Org server. In the XISendDeviceHierarchyEvent function, it is possible to exceed the allocated array length when…
• CVE-2024-21886 — CVSS 7.8 (high): A heap buffer overflow flaw was found in the DisableDevice function in the X.Org server. This issue may lead to an application crash or, in…
• CVE-2024-31083 — CVSS 7.8 (high): A use-after-free vulnerability was found in the ProcRenderAddGlyphs() function of Xorg servers. This issue occurs when AllocateGlyph() is…
• CVE-2024-9632 — CVSS 7.8 (high): A flaw was found in the X.org server. Due to improperly tracked allocation size in _XkbSetCompatMap, a local attacker may be able to…
• CVE-2025-49180 — CVSS 7.8 (high): A flaw was found in the RandR extension, where the RRChangeProviderProperty function does not properly validate input. This issue leads to…
• CVE-2026-33999 — CVSS 7.8 (high): A flaw was found in the X.Org X server. This integer underflow vulnerability, specifically in the XKB compatibility map handling, allows an…
• CVE-2026-34001 — CVSS 7.8 (high): A flaw was found in the X.Org X server. This use-after-free vulnerability occurs in the XSYNC fence triggering logic, specifically within…
• CVE-2026-34003 — CVSS 7.8 (high): A flaw was found in the X.Org X server's XKB key types request validation. A local attacker could send a specially crafted request to the X…
• CVE-2026-50256 — CVSS 7.8 (high): A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2…
• CVE-2026-50257 — CVSS 7.8 (high): A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence(). A client that sets up multiple fence triggers…
• CVE-2026-50258 — CVSS 7.8 (high): A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. The X server has multiple stack buffers sized…
• CVE-2026-50259 — CVSS 7.8 (high): A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. _XkbSetMapChecks() declares a fixed-size stack buffer…
• CVE-2026-50260 — CVSS 7.8 (high): A use-after-free flaw was found in the X.Org X server and Xwayland in FreeCounter(). A client that sets up multiple SyncCounters and awaits…
• CVE-2026-50261 — CVSS 7.8 (high): A use-after-free flaw was found in the X.Org X server and Xwayland in SyncChangeCounter(). A client that sets up multiple SyncCounters can…
• CVE-2021-4008 — CVSS 7.8 (high): A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in the…
• CVE-2023-0494 — CVSS 7.8 (high): A vulnerability was found in X.Org. This issue occurs due to a dangling pointer in DeepCopyPointerClasses that can be exploited by…
• CVE-2023-1393 — CVSS 7.8 (high): A flaw was found in X.Org Server Overlay Window. A Use-After-Free may lead to local privilege escalation. If a client explicitly destroys…
• CVE-2023-5367 — CVSS 7.8 (high): A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect calculation of a buffer offset when…
• CVE-2023-6377 — CVSS 7.8 (high): A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to a mouse can result in…
• CVE-2024-0229 — CVSS 7.8 (high): An out-of-bounds memory access flaw was found in the X.Org server. This issue can be triggered when a device frozen by a sync grab is…
• CVE-2023-6478 — CVSS 7.6 (high): A flaw was found in xorg-server. A specially crafted request to RRChangeProviderProperty or RRChangeOutputProperty can trigger an integer…
• CVE-2025-62231 — CVSS 7.3 (high): A flaw was identified in the X.Org X server’s X Keyboard (Xkb) extension where improper bounds checking in the XkbSetCompatMap() function…
• CVE-2025-49176 — CVSS 7.3 (high): A flaw was found in the Big Requests extension. The request length is multiplied by 4 before checking against the maximum allowed size…
• CVE-2025-49179 — CVSS 7.3 (high): A flaw was found in the X Record extension. The RecordSanityCheckRegisterClients function does not check for an integer overflow when…
• CVE-2025-62229 — CVSS 7.3 (high): A flaw was found in the X.Org X server and Xwayland when processing X11 Present extension notifications. Improper error handling during…
• CVE-2025-62230 — CVSS 7.3 (high): A flaw was discovered in the X.Org X server’s X Keyboard (Xkb) extension when handling client resource cleanup. The software frees…
• CVE-2024-31080 — CVSS 7.3 (high): A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIGetSelectedEvents() function. This issue occurs when…
• CVE-2024-31081 — CVSS 7.3 (high): A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIPassiveGrabDevice() function. This issue occurs when…
• CVE-2025-49175 — CVSS 6.1 (medium): A flaw was found in the X Rendering extension's handling of animated cursors. If a client provides no cursors, the server assumes at least…
• CVE-2024-0408 — CVSS 5.5 (medium): A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the buffer, leaving it unlabeled. When…
• CVE-2026-50263 — CVSS 5.5 (medium): A use-after-free flaw was found in the X.Org X server and Xwayland in CreateSaverWindow(). A client can trigger a use-after-free read after…
• CVE-2026-50262 — CVSS 5.5 (medium): An out-of-bounds read flaw was found in the X.Org X server and Xwayland in __glXDisp_ChangeDrawableAttributes(). A wrong size validation…
• CVE-2022-3550 — CVSS 5.5 (medium): A vulnerability classified as critical was found in X.org Server. Affected by this vulnerability is the function _GetCountedString of the…
• CVE-2025-49178 — CVSS 5.5 (medium): A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' in a client's request can cause the server to skip…
• CVE-2023-5380 — CVSS 4.7 (medium): A use-after-free flaw was found in the xorg-x11-server. An X server crash may occur in a very specific and legacy configuration (a…
• CVE-2022-3551 — CVSS 3.5 (low): A vulnerability, which was classified as problematic, has been found in X.org Server. Affected by this issue is the function…