Every CVE whose affected-product data names X.org X Server, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.
CVEs (95)
CVE-2017-12176 — CVSS 9.8 (critical): xorg-x11-server before 1.19.5 was missing extra length validation in ProcEstablishConnection function allowing malicious X client to cause…
CVE-2023-6816 — CVSS 9.8 (critical): A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down…
CVE-2017-12183 — CVSS 9.8 (critical): xorg-x11-server before 1.19.5 was missing length validation in XFIXES extension allowing malicious X client to cause X server to crash or…
CVE-2017-12182 — CVSS 9.8 (critical): xorg-x11-server before 1.19.5 was missing length validation in XFree86 DRI extension allowing malicious X client to cause X server to crash…
CVE-2017-12181 — CVSS 9.8 (critical): xorg-x11-server before 1.19.5 was missing length validation in XFree86 DGA extension allowing malicious X client to cause X server to crash…
CVE-2017-12180 — CVSS 9.8 (critical): xorg-x11-server before 1.19.5 was missing length validation in XFree86 VidModeExtension allowing malicious X client to cause X server to…
CVE-2017-12179 — CVSS 9.8 (critical): xorg-x11-server before 1.19.5 was vulnerable to integer overflow in (S)ProcXIBarrierReleasePointer functions allowing malicious X client to…
CVE-2017-12178 — CVSS 9.8 (critical): xorg-x11-server before 1.19.5 had wrong extra length check in ProcXIChangeHierarchy function allowing malicious X client to cause X server…
CVE-2017-12177 — CVSS 9.8 (critical): xorg-x11-server before 1.19.5 was vulnerable to integer overflow in ProcDbeGetVisualInfo function allowing malicious X client to cause X…
CVE-2017-12187 — CVSS 9.8 (critical): xorg-x11-server before 1.19.5 was missing length validation in RENDER extension allowing malicious X client to cause X server to crash or…
CVE-2017-12186 — CVSS 9.8 (critical): xorg-x11-server before 1.19.5 was missing length validation in X-Resource extension allowing malicious X client to cause X server to crash…
CVE-2017-12185 — CVSS 9.8 (critical): xorg-x11-server before 1.19.5 was missing length validation in MIT-SCREEN-SAVER extension allowing malicious X client to cause X server to…
CVE-2017-12184 — CVSS 9.8 (critical): xorg-x11-server before 1.19.5 was missing length validation in XINERAMA extension allowing malicious X client to cause X server to crash or…
CVE-2007-6427 — CVSS 9.3 (critical): The XInput extension in X.Org Xserver before 1.4.1 allows context-dependent attackers to execute arbitrary code via requests related to…
CVE-2022-46343 — CVSS 8.8 (high): A vulnerability was found in X.Org. This security flaw occurs because the handler for the ScreenSaverSetAttributes request may write to…
CVE-2022-46342 — CVSS 8.8 (high): A vulnerability was found in X.Org. This security flaw occurs because the handler for the XvdiSelectVideoNotify request may write to memory…
CVE-2022-46344 — CVSS 8.8 (high): A vulnerability was found in X.Org. This security flaw occurs because the handler for the XIChangeProperty request has a length-validation…
CVE-2022-46340 — CVSS 8.8 (high): A vulnerability was found in X.Org. This security flaw occurs becuase the swap handler for the XTestFakeInput request of the XTest…
CVE-2017-10971 — CVSS 8.8 (high): In the X.Org X server before 2017-06-19, a user authenticated to an X Session could crash or execute code in the context of the X Server by…
CVE-2022-46341 — CVSS 8.8 (high): A vulnerability was found in X.Org. This security flaw occurs because the handler for the XIPassiveUngrab request accesses out-of-bounds…
CVE-2021-3472 — CVSS 7.8 (high): A flaw was found in xorg-x11-server in versions before 1.20.11. An integer underflow can occur in xserver which can lead to a local…
CVE-2017-13723 — CVSS 7.8 (high): In X.Org Server (aka xserver and xorg-server) before 1.19.4, a local attacker authenticated to the X server could overflow a global buffer…
CVE-2019-17624 — CVSS 7.8 (high): "" In X.Org X Server 1.20.4, there is a stack-based buffer overflow in the function XQueryKeymap. For example, by sending ct.c_char 1000…
CVE-2020-14345 — CVSS 7.8 (high): A flaw was found in X.Org Server before xorg-x11-server 1.20.9. An Out-Of-Bounds access in XkbSetNames function may lead to a privilege…
CVE-2020-14346 — CVSS 7.8 (high): A flaw was found in xorg-x11-server before 1.20.9. An integer underflow in the X input extension protocol decoding in the X server may lead…
CVE-2020-14360 — CVSS 7.8 (high): A flaw was found in the X.Org Server before version 1.20.10. An out-of-bounds access in the XkbSetMap function may lead to a privilege…
CVE-2020-14361 — CVSS 7.8 (high): A flaw was found in X.Org Server before xorg-x11-server 1.20.9. An Integer underflow leading to heap-buffer overflow may lead to a…
CVE-2020-14362 — CVSS 7.8 (high): A flaw was found in X.Org Server before xorg-x11-server 1.20.9. An Integer underflow leading to heap-buffer overflow may lead to a…
CVE-2020-25712 — CVSS 7.8 (high): A flaw was found in xorg-x11-server before 1.20.10. A heap-buffer overflow in XkbSetDeviceInfo may lead to a privilege escalation…
CVE-2021-4008 — CVSS 7.8 (high): A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in the…
CVE-2021-4009 — CVSS 7.8 (high): A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in the…
CVE-2021-4010 — CVSS 7.8 (high): A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in the…
CVE-2021-4011 — CVSS 7.8 (high): A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in the…
CVE-2022-2319 — CVSS 7.8 (high): A flaw was found in the Xorg-x11-server. An out-of-bounds access issue can occur in the ProcXkbSetGeometry function due to improper…
CVE-2022-2320 — CVSS 7.8 (high): A flaw was found in the Xorg-x11-server. The specific flaw exists within the handling of ProcXkbSetDeviceInfo requests. The issue results…
CVE-2022-4283 — CVSS 7.8 (high): A vulnerability was found in X.Org. This security flaw occurs because the XkbCopyNames function left a dangling pointer to freed memory…
CVE-2023-0494 — CVSS 7.8 (high): A vulnerability was found in X.Org. This issue occurs due to a dangling pointer in DeepCopyPointerClasses that can be exploited by…
CVE-2023-1393 — CVSS 7.8 (high): A flaw was found in X.Org Server Overlay Window. A Use-After-Free may lead to local privilege escalation. If a client explicitly destroys…
CVE-2023-5367 — CVSS 7.8 (high): A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect calculation of a buffer offset when…
CVE-2023-6377 — CVSS 7.8 (high): A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to a mouse can result in…
CVE-2024-0229 — CVSS 7.8 (high): An out-of-bounds memory access flaw was found in the X.Org server. This issue can be triggered when a device frozen by a sync grab is…
CVE-2024-0409 — CVSS 7.8 (high): A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the…
CVE-2025-26594 — CVSS 7.8 (high): A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a global variable. If a client…
CVE-2025-26595 — CVSS 7.8 (high): A buffer overflow flaw was found in X.Org and Xwayland. The code in XkbVModMaskText() allocates a fixed-sized buffer on the stack and…
CVE-2025-26596 — CVSS 7.8 (high): A heap overflow flaw was found in X.Org and Xwayland. The computation of the length in XkbSizeKeySyms() differs from what is written in…
CVE-2025-26597 — CVSS 7.8 (high): A buffer overflow flaw was found in X.Org and Xwayland. If XkbChangeTypesOfKey() is called with a 0 group, it will resize the key symbols…
CVE-2025-26598 — CVSS 7.8 (high): An out-of-bounds write flaw was found in X.Org and Xwayland. The function GetBarrierDevice() searches for the pointer device based on its…
CVE-2025-26599 — CVSS 7.8 (high): An access to an uninitialized pointer flaw was found in X.Org and Xwayland. The function compCheckRedirect() may fail if it cannot allocate…
CVE-2025-26600 — CVSS 7.8 (high): A use-after-free flaw was found in X.Org and Xwayland. When a device is removed while still frozen, the events queued for that device…
CVE-2025-26601 — CVSS 7.8 (high): A use-after-free flaw was found in X.Org and Xwayland. When changing an alarm, the values of the change mask are evaluated one after the…
CVE-2026-50256 — CVSS 7.8 (high): A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2…
CVE-2026-50257 — CVSS 7.8 (high): A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence(). A client that sets up multiple fence triggers…
CVE-2026-50258 — CVSS 7.8 (high): A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. The X server has multiple stack buffers sized…
CVE-2026-50259 — CVSS 7.8 (high): A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. _XkbSetMapChecks() declares a fixed-size stack buffer…
CVE-2026-50260 — CVSS 7.8 (high): A use-after-free flaw was found in the X.Org X server and Xwayland in FreeCounter(). A client that sets up multiple SyncCounters and awaits…
CVE-2026-50261 — CVSS 7.8 (high): A use-after-free flaw was found in the X.Org X server and Xwayland in SyncChangeCounter(). A client that sets up multiple SyncCounters can…
CVE-2026-50264 — CVSS 7.8 (high): An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat. A client that requests…
CVE-2023-6478 — CVSS 7.6 (high): A flaw was found in xorg-server. A specially crafted request to RRChangeProviderProperty or RRChangeOutputProperty can trigger an integer…
CVE-2015-3418 — CVSS 7.5 (high): The ProcPutImage function in dix/dispatch.c in X.Org Server (aka xserver and xorg-server) before 1.16.4 allows attackers to cause a denial…
CVE-2025-62230 — CVSS 7.3 (high): A flaw was discovered in the X.Org X server’s X Keyboard (Xkb) extension when handling client resource cleanup. The software frees…
CVE-2025-62231 — CVSS 7.3 (high): A flaw was identified in the X.Org X server’s X Keyboard (Xkb) extension where improper bounds checking in the XkbSetCompatMap() function…
CVE-2023-5574 — CVSS 7.0 (high): A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a…
CVE-2020-25697 — CVSS 7.0 (high): A privilege escalation flaw was found in the Xorg-x11-server due to a lack of authentication for X11 clients. This flaw allows an attacker…
CVE-2018-14665 — CVSS 6.6 (medium): A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X…
CVE-2014-8099 — CVSS 6.5 (medium): The XVideo extension in XFree86 4.0.0, X.Org X Window System (aka X11 or X) X11R6.7, and X.Org Server (aka xserver and xorg-server) before…
CVE-2014-8098 — CVSS 6.5 (medium): The GLX extension in XFree86 4.0, X.Org X Window System (aka X11 or X) X11R6.7, and X.Org Server (aka xserver and xorg-server) before…
CVE-2014-8097 — CVSS 6.5 (medium): The DBE extension in X.Org X Window System (aka X11 or X) X11R6.1 and X.Org Server (aka xserver and xorg-server) before 1.16.3 allows…
CVE-2014-8096 — CVSS 6.5 (medium): The SProcXCMiscGetXIDList function in the XC-MISC extension in X.Org X Window System (aka X11 or X) X11R6.0 and X.Org Server (aka xserver…
CVE-2014-8095 — CVSS 6.5 (medium): The XInput extension in X.Org X Window System (aka X11 or X) X11R4 and X.Org Server (aka xserver and xorg-server) before 1.16.3 allows…
CVE-2014-8092 — CVSS 6.5 (medium): Multiple integer overflows in X.Org X Window System (aka X11 or X) X11R1 and X.Org Server (aka xserver and xorg-server) before 1.16.3 allow…
CVE-2014-8093 — CVSS 6.5 (medium): Multiple integer overflows in the GLX extension in XFree86 4.0, X.Org X Window System (aka X11 or X) X11R6.7, and X.Org Server (aka xserver…
CVE-2017-10972 — CVSS 6.5 (medium): Uninitialized data in endianness conversion in the XEvent handling of the X.Org X Server before 2017-06-19 allowed authenticated malicious…
CVE-2014-8103 — CVSS 6.5 (medium): X.Org Server (aka xserver and xorg-server) 1.15.0 through 1.16.x before 1.16.3 allows remote authenticated users to cause a denial of…
CVE-2014-8102 — CVSS 6.5 (medium): The SProcXFixesSelectSelectionInput function in the XFixes extension in X.Org X Window System (aka X11 or X) X11R6.8.0 and X.Org Server…
CVE-2014-8101 — CVSS 6.5 (medium): The RandR extension in XFree86 4.2.0, X.Org X Window System (aka X11 or X) X11R6.7, and X.Org Server (aka xserver and xorg-server) before…
CVE-2014-8100 — CVSS 6.5 (medium): The Render extension in XFree86 4.0.1, X.Org X Window System (aka X11 or X) X11R6.7, and X.Org Server (aka xserver and xorg-server) before…
CVE-2014-8094 — CVSS 6.5 (medium): Integer overflow in the ProcDRI2GetBuffers function in the DRI2 extension in X.Org Server (aka xserver and xorg-server) 1.7.0 through…
CVE-2015-0255 — CVSS 6.4 (medium): X.Org Server (aka xserver and xorg-server) before 1.16.3 and 1.17.x before 1.17.1 allows remote attackers to obtain sensitive information…
CVE-2026-34002 — CVSS 6.1 (medium): A flaw was found in the X.Org X server. This vulnerability, an out-of-bounds read, affects the XKB (X Keyboard Extension) modifier map…
CVE-2026-34000 — CVSS 6.1 (medium): A flaw was found in the X.Org X server. This out-of-bounds read vulnerability in the XKB geometry processing, specifically within the…
CVE-2017-2624 — CVSS 5.9 (medium): It was found that xorg-x11-server before 1.19.0 including uses memcmp() to check the received MIT cookie against a series of valid cookies…
CVE-2026-50263 — CVSS 5.5 (medium): A use-after-free flaw was found in the X.Org X server and Xwayland in CreateSaverWindow(). A client can trigger a use-after-free read after…
CVE-2026-50262 — CVSS 5.5 (medium): An out-of-bounds read flaw was found in the X.Org X server and Xwayland in __glXDisp_ChangeDrawableAttributes(). A wrong size validation…
CVE-2022-3550 — CVSS 5.5 (medium): A vulnerability classified as critical was found in X.org Server. Affected by this vulnerability is the function _GetCountedString of the…
CVE-2024-0408 — CVSS 5.5 (medium): A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the buffer, leaving it unlabeled. When…
CVE-2020-14347 — CVSS 5.5 (medium): A flaw was found in the way xserver memory was not properly initialized. This could leak parts of server memory to the X client. In cases…
CVE-2023-5380 — CVSS 4.7 (medium): A use-after-free flaw was found in the xorg-x11-server. An X server crash may occur in a very specific and legacy configuration (a…
CVE-2017-13721 — CVSS 4.7 (medium): In X.Org Server (aka xserver and xorg-server) before 1.19.4, an attacker authenticated to an X server with the X shared memory extension…
CVE-2011-4613 — CVSS 4.6 (medium): The X.Org X wrapper (xserver-wrapper.c) in Debian GNU/Linux and Ubuntu Linux does not properly verify the TTY of a user who is starting X…
CVE-2014-8091 — CVSS 4.3 (medium): X.Org X Window System (aka X11 and X) X11R5 and X.Org Server (aka xserver and xorg-server) before 1.16.3, when using SUN-DES-1 (Secure RPC)…
CVE-2015-3164 — CVSS 3.6 (low): The authentication setup in XWayland 1.16.x and 1.17.x before 1.17.2 starts the server in non-authenticating mode, which allows local users…
CVE-2022-3551 — CVSS 3.5 (low): A vulnerability, which was classified as problematic, has been found in X.org Server. Affected by this issue is the function…
CVE-2022-3553 — CVSS 3.5 (low): A vulnerability, which was classified as problematic, was found in X.org Server. This affects an unknown part of the file…
CVE-2011-4029 — CVSS 1.9 (low): The LockServer function in os/utils.c in X.Org xserver before 1.11.2 allows local users to change the permissions of arbitrary files to…
CVE-2011-4028 — CVSS 1.2 (low): The LockServer function in os/utils.c in X.Org xserver before 1.11.2 allows local users to determine the existence of arbitrary files via a…