CVE-2012-2118

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-05-18 · updated 2026-06-16
Weakness: CWE-20

Description

Format string vulnerability in the LogVHdrMessageVerb function in os/log.c in X.Org X11 1.11 allows attackers to cause a denial of service or possibly execute arbitrary code via format string specifiers in an input device name.

Affected products

X.Org X11: 1.11

References

http://patchwork.freedesktop.org/patch/10001/
http://www.openwall.com/lists/oss-security/2012/04/18/8
http://www.openwall.com/lists/oss-security/2012/04/19/2
http://www.securityfocus.com/bid/53150
https://exchange.xforce.ibmcloud.com/vulnerabilities/74930
http://patchwork.freedesktop.org/patch/10001/
http://www.openwall.com/lists/oss-security/2012/04/18/8
http://www.openwall.com/lists/oss-security/2012/04/19/2
http://www.securityfocus.com/bid/53150
https://exchange.xforce.ibmcloud.com/vulnerabilities/74930

Get alerted when CVE-2012-2118 or the next vulnerability affects your stack