7.8

CVE-2024-9632: xorg-server Heap-based Buffer Overflow

CVSS: 7.8v3.1HighDeferred
AliasesMGASA-2024-0357SUSE-SU-2024:3786-1SUSE-SU-2024:3787-1
Published 30-10-2024Last modified 18-03-2026
Open JSON

Vulnerability summary

CVE-2024-9632 is a high (CVSS 7.8) Heap-based Buffer Overflow vulnerability in xorg-server. EPSS estimates a 0.90% chance of exploitation in the next 30 days, higher than 59.1% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.90%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 4
RHSA-2025:12751RHSA-2025:7163RHSA-2025:7165RHSA-2025:7458

Timeline

  1. 30-10-2024
    PublishedVulnerability first disclosed.
  2. 18-03-2026
    Last modifiedVulnerability information updated.

Description

A flaw was found in the X.org server. Due to improperly tracked allocation size in _XkbSetCompatMap, a local attacker may be able to trigger a buffer overflow condition via a specially crafted payload, leading to denial of service or local privilege escalation in distributions where the X.org server is run with root privileges.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.90%

Chance of exploitation in the next 30 days

Percentile

59%

Versus all other CVEs

30-day change

0.00 pp

From 0.90% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.90%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Redhat32 products
  • tigervnc< 0:1.13.1-14.el8_10 | < 0:1.12.0-14.el9_2.9 | < 0:1.11.0-22.el9_0.12 | < 0:1.12.0-15.el8_8.11 | < 0:1.13.1-8.el9_4.4 | < 0:1.9.0-15.el8_2.12 | < 0:1.11.0-8.el8_4.11 | < 0:1.12.0-6.el8_6.12 | < 0:1.8.0-34.el7_9 | < 0:1.14.1-1.el9_5
  • tigervnc-debuginfo< 0:1.13.1-14.el8_10 | < 0:1.12.0-14.el9_2.9 | < 0:1.11.0-22.el9_0.12 | < 0:1.12.0-15.el8_8.11 | < 0:1.13.1-8.el9_4.4 | < 0:1.9.0-15.el8_2.12 | < 0:1.11.0-8.el8_4.11 | < 0:1.12.0-6.el8_6.12 | < 0:1.8.0-34.el7_9 | < 0:1.14.1-1.el9_5
  • tigervnc-debugsource< 0:1.13.1-14.el8_10 | < 0:1.12.0-14.el9_2.9 | < 0:1.11.0-22.el9_0.12 | < 0:1.12.0-15.el8_8.11 | < 0:1.13.1-8.el9_4.4 | < 0:1.9.0-15.el8_2.12 | < 0:1.11.0-8.el8_4.11 | < 0:1.12.0-6.el8_6.12 | < 0:1.14.1-1.el9_5
  • tigervnc-icons< 0:1.13.1-14.el8_10 | < 0:1.12.0-14.el9_2.9 | < 0:1.11.0-22.el9_0.12 | < 0:1.12.0-15.el8_8.11 | < 0:1.13.1-8.el9_4.4 | < 0:1.9.0-15.el8_2.12 | < 0:1.11.0-8.el8_4.11 | < 0:1.12.0-6.el8_6.12 | < 0:1.8.0-34.el7_9 | < 0:1.14.1-1.el9_5
  • tigervnc-license< 0:1.13.1-14.el8_10 | < 0:1.12.0-14.el9_2.9 | < 0:1.11.0-22.el9_0.12 | < 0:1.12.0-15.el8_8.11 | < 0:1.13.1-8.el9_4.4 | < 0:1.9.0-15.el8_2.12 | < 0:1.11.0-8.el8_4.11 | < 0:1.12.0-6.el8_6.12 | < 0:1.8.0-34.el7_9 | < 0:1.14.1-1.el9_5
Suse23 products
  • xorg-x11-server&distro=SUSE Enterprise Storage 7.1< 1.20.3-150200.22.5.99.1
  • xorg-x11-server&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS< 1.20.3-150200.22.5.99.1
  • xorg-x11-server&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS< 1.20.3-150200.22.5.99.1
  • xorg-x11-server&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 1.20.3-150400.38.51.1
  • xorg-x11-server&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 1.20.3-150400.38.51.1
Opensuse6 products
  • xorg-x11-server&distro=openSUSE Leap 15.5< 21.1.4-150500.7.29.1
  • xorg-x11-server&distro=openSUSE Leap 15.6< 21.1.11-150600.5.3.1
  • xorg-x11-server&distro=openSUSE Tumbleweed< 21.1.14-1.1
  • xwayland&distro=openSUSE Leap 15.5< 22.1.5-150500.7.25.1
  • xwayland&distro=openSUSE Leap 15.6< 24.1.1-150600.5.6.1
Ubuntu4 products
  • xorg-serverAll versions (No fix recorded) | < 2:1.20.13-1ubuntu1~20.04.18 | < 2:21.1.4-2ubuntu1.7~22.04.12 | < 2:21.1.12-1ubuntu1.1 | < 2:1.18.4-0ubuntu0.12+esm14 | < 2:1.19.6-1ubuntu4.15+esm9
  • xorg-server-hwe-16.04< 2:1.19.6-1ubuntu4.1~16.04.6+esm6
  • xorg-server-hwe-18.04< 2:1.20.8-2ubuntu2.2~18.04.11+esm1
  • xwayland< 2:22.1.1-1ubuntu0.14 | < 2:23.2.6-1ubuntu0.1
Mageia3 products
  • tigervnc< 1.13.1-2.6.mga9
  • x11-server< 21.1.8-7.6.mga9
  • x11-server-xwayland< 22.1.9-1.6.mga9
Debian2 products
  • xorg-server< 2:21.1.13-3.1 | < 2:21.1.7-3+deb12u8 | < 2:1.20.11-1+deb11u14
  • xwaylandAll versions (No fix recorded) | < 2:24.1.4-1

6 vendors · 70 products

References

53 links
Show all 53 references