CVE-2022-46344: debian debian_linux Out-of-bounds Read
Vulnerability summary
CVE-2022-46344 is a high (CVSS 8.8) Out-of-bounds Read vulnerability in debian debian_linux. EPSS estimates a 2.90% chance of exploitation in the next 30 days, higher than 86.7% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 24 · Related 12Timeline
- 14-12-2022PublishedVulnerability first disclosed.
- 13-02-2025Last modifiedVulnerability information updated.
Description
A vulnerability was found in X.Org. This security flaw occurs because the handler for the XIChangeProperty request has a length-validation issues, resulting in out-of-bounds memory reads and potential information disclosure. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
2.90%
Chance of exploitation in the next 30 days
Percentile
87%
Versus all other CVEs
30-day change
+0.21 pp
From 2.69% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu4 products
- xorg-server< 2:1.15.1-0ubuntu2.11+esm7 | < 2:1.18.4-0ubuntu0.12+esm5 | < 2:1.19.6-1ubuntu4.13 | < 2:1.20.13-1ubuntu1~20.04.5 | < 2:21.1.3-2ubuntu2.5
- xorg-server-hwe-16.04< 2:1.19.6-1ubuntu4.1~16.04.6+esm4
- xorg-server-hwe-18.04< 2:1.20.8-2ubuntu2.2~18.04.9
- xwayland< 2:22.1.1-1ubuntu0.4
Debian3 products
- xorg-server< 2:21.1.5-1
- xwayland< 2:22.1.6-1
- debian_linuxEOL11.0
Fedoraproject1 product
- fedoraEOL36 | 37
X.org1 product
- x_server1.20.4
4 vendors · 9 products
References
13 links- access.redhat.com/security/cve/CVE-2022-46344Third Party Advisory
