8.8

CVE-2022-46340: debian debian_linux Out-of-bounds Write

CVSS: 8.8v3.1HighModified
AliasesSUSE-SU-2023:0653-1SUSE-SU-2023:0654-1SUSE-SU-2023:0655-1
Published 14-12-2022Last modified 22-04-2025
Open JSON

Vulnerability summary

CVE-2022-46340 is a high (CVSS 8.8) Out-of-bounds Write vulnerability in debian debian_linux. EPSS estimates a 2.68% chance of exploitation in the next 30 days, higher than 85.6% of scored vulnerabilities.

Overall risk
36/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.8/10
010
High · v3.1 (CVE.org)
EPSS score
2.68%
0%100%
Low · +0.20 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 24 · Related 12
DLA-3256-1DSA-5304-1MGASA-2023-0012OPENSUSE-SU-2024:12569-1OPENSUSE-SU-2024:12570-1RHSA-2023:0045

Timeline

  1. 14-12-2022
    PublishedVulnerability first disclosed.
  2. 22-04-2025
    Last modifiedVulnerability information updated.

Description

A vulnerability was found in X.Org. This security flaw occurs becuase the swap handler for the XTestFakeInput request of the XTest extension may corrupt the stack if GenericEvents with lengths larger than 32 bytes are sent through a the XTestFakeInput request. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions. This issue does not affect systems where client and server use the same byte order.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

2.68%

Chance of exploitation in the next 30 days

Percentile

86%

Versus all other CVEs

30-day change

+0.20 pp

From 2.48% on 19-09-2026

19-09-202619-10-2026
EPSS score
2.68%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse28 products
  • xorg-x11-server&distro=SUSE Enterprise Storage 7< 1.20.3-150200.22.5.69.1
  • xorg-x11-server&distro=SUSE Enterprise Storage 7.1< 1.20.3-150200.22.5.69.1
  • xorg-x11-server&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 1.20.3-150100.14.5.39.1
  • xorg-x11-server&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS< 1.20.3-150200.22.5.69.1
  • xorg-x11-server&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS< 1.20.3-150200.22.5.69.1
Ubuntu4 products
  • xorg-server< 2:1.15.1-0ubuntu2.11+esm7 | < 2:1.18.4-0ubuntu0.12+esm5 | < 2:1.19.6-1ubuntu4.13 | < 2:1.20.13-1ubuntu1~20.04.5 | < 2:21.1.3-2ubuntu2.5
  • xorg-server-hwe-16.04< 2:1.19.6-1ubuntu4.1~16.04.6+esm4
  • xorg-server-hwe-18.04< 2:1.20.8-2ubuntu2.2~18.04.9
  • xwayland< 2:22.1.1-1ubuntu0.4
Debian3 products
  • xorg-server< 2:21.1.5-1
  • xwayland< 2:22.1.6-1
  • debian_linuxEOL11.0
Opensuse2 products
  • xorg-x11-server&distro=openSUSE Leap 15.4< 1.20.3-150200.22.5.69.1 | < 1.20.3-150400.38.19.1
  • xwayland&distro=openSUSE Leap 15.4< 21.1.4-150400.3.12.1
Fedoraproject1 product
X.org1 product

6 vendors · 39 products

References

22 links
Show all 22 references