CVE-2023-5380: Xorg-x11-server: use-after-free bug in destroywindow

Severity: medium (CVSS 4.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-10-25 · updated 2026-06-23
Weakness: CWE-416

Description

A use-after-free flaw was found in the xorg-x11-server. An X server crash may occur in a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode) if the pointer is warped from within a window on one screen to the root window of the other screen and if the original window is destroyed followed by another window being destroyed.

Affected products

Debian Linux: 11.0, 12.0
Fedoraproject Fedora: 37, 38, 39
Red Hat Enterprise Linux: 7.0, 8.0, 9.0
xorg-x11-server: before 21.1.9 — fixed in 21.1.9
X.Org xwayland: before 23.2.2 — fixed in 23.2.2

How to fix

Upgrade to a fixed version: xorg-x11-server 21.1.9; X.Org xwayland 23.2.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-5380 or the next vulnerability affects your stack