7.8

CVE-2023-1393: fedoraproject fedora Use After Free

CVSS: 7.8v3.1HighModified
AliasesMGASA-2023-0131SUSE-SU-2023:1674-1SUSE-SU-2023:1675-1
Published 30-03-2023Last modified 22-01-2026
Open JSON

Vulnerability summary

CVE-2023-1393 is a high (CVSS 7.8) Use After Free vulnerability in fedoraproject fedora. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 36.8% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.44%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1
RHSA-2025:12751

Timeline

  1. 30-03-2023
    PublishedVulnerability first disclosed.
  2. 22-01-2026
    Last modifiedVulnerability information updated.

Description

A flaw was found in X.Org Server Overlay Window. A Use-After-Free may lead to local privilege escalation. If a client explicitly destroys the compositor overlay window (aka COW), the Xserver would leave a dangling pointer to that window in the CompScreen structure, which will trigger a use-after-free later.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.44%

Chance of exploitation in the next 30 days

Percentile

37%

Versus all other CVEs

30-day change

0.00 pp

From 0.44% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.44%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Redhat32 products
  • tigervnc< 0:1.11.0-8.el8_4.2 | < 0:1.9.0-15.el8_2.3 | < 0:1.12.0-9.el8_7.3 | < 0:1.12.0-5.el9_1.2 | < 0:1.8.0-25.el7_9 | < 0:1.12.0-6.el8_6.3 | < 0:1.11.0-22.el9_0.2 | < 0:1.9.0-16.el8_1.3
  • tigervnc-debuginfo< 0:1.11.0-8.el8_4.2 | < 0:1.9.0-15.el8_2.3 | < 0:1.12.0-9.el8_7.3 | < 0:1.12.0-5.el9_1.2 | < 0:1.8.0-25.el7_9 | < 0:1.12.0-6.el8_6.3 | < 0:1.11.0-22.el9_0.2 | < 0:1.9.0-16.el8_1.3
  • tigervnc-debugsource< 0:1.11.0-8.el8_4.2 | < 0:1.9.0-15.el8_2.3 | < 0:1.12.0-9.el8_7.3 | < 0:1.12.0-5.el9_1.2 | < 0:1.12.0-6.el8_6.3 | < 0:1.11.0-22.el9_0.2 | < 0:1.9.0-16.el8_1.3
  • tigervnc-icons< 0:1.11.0-8.el8_4.2 | < 0:1.9.0-15.el8_2.3 | < 0:1.12.0-9.el8_7.3 | < 0:1.12.0-5.el9_1.2 | < 0:1.8.0-25.el7_9 | < 0:1.12.0-6.el8_6.3 | < 0:1.11.0-22.el9_0.2 | < 0:1.9.0-16.el8_1.3
  • tigervnc-license< 0:1.11.0-8.el8_4.2 | < 0:1.9.0-15.el8_2.3 | < 0:1.12.0-9.el8_7.3 | < 0:1.12.0-5.el9_1.2 | < 0:1.8.0-25.el7_9 | < 0:1.12.0-6.el8_6.3 | < 0:1.11.0-22.el9_0.2 | < 0:1.9.0-16.el8_1.3
Suse28 products
  • xorg-x11-server&distro=SUSE Enterprise Storage 7< 1.20.3-150200.22.5.72.1
  • xorg-x11-server&distro=SUSE Enterprise Storage 7.1< 1.20.3-150200.22.5.72.1
  • xorg-x11-server&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 1.20.3-150100.14.5.42.1
  • xorg-x11-server&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS< 1.20.3-150200.22.5.72.1
  • xorg-x11-server&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS< 1.20.3-150200.22.5.72.1
Ubuntu5 products
  • tigervncAll versions (No fix recorded) | < 1.10.1+dfsg-3ubuntu0.20.04.1 | < 1.12.0+dfsg-4ubuntu0.22.04.1
  • xorg-serverAll versions (No fix recorded) | < 2:1.19.6-1ubuntu4.15 | < 2:1.20.13-1ubuntu1~20.04.8 | < 2:21.1.3-2ubuntu2.9
  • xorg-server-hwe-16.04All versions (No fix recorded)
  • xorg-server-hwe-18.04< 2:1.20.8-2ubuntu2.2~18.04.11
  • xwayland< 2:22.1.1-1ubuntu0.6
Opensuse4 products
  • xorg-x11-server&distro=openSUSE Leap 15.4< 1.20.3-150400.38.22.1 | < 1.20.3-150200.22.5.72.1
  • xorg-x11-server&distro=openSUSE Tumbleweed< 21.1.7-2.1
  • xwayland&distro=openSUSE Leap 15.4< 21.1.4-150400.3.15.1
  • xwayland&distro=openSUSE Tumbleweed< 23.1.1-1.1
Debian2 products
  • xorg-server< 2:21.1.7-2 | < 2:1.20.11-1+deb11u6 | < 2:1.20.4-1+deb10u9
  • xwayland< 2:22.1.9-1
Mageia2 products
  • tigervnc< 1.11.0-4.3.mga8
  • x11-server< 1.20.14-4.3.mga8
Fedoraproject1 product
X.org1 product

8 vendors · 75 products

References

65 links
Show all 65 references