CVE-2024-21885 HIGH

CVE-2024-21885: Xorg-x11-server: heap buffer overflow in xisenddevicehierarchyevent

Vendor Red Hat
Product Red Hat Enterprise Linux 6
Weakness CWE-122
Published February 28, 2024
Last update November 6, 2025
View on NVD All CVEs

CVSS base score

7.8/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

A flaw was found in X.Org server. In the XISendDeviceHierarchyEvent function, it is possible to exceed the allocated array length when certain new device IDs are added to the xXIHierarchyInfo struct. This can trigger a heap buffer overflow condition, which may lead to an application crash or remote code execution in SSH X11 forwarding environments.

Key dates

02Disclosure timeline

February 28, 2024 CVE published
November 6, 2025 Record updated