CVE-2023-6816: Xorg-x11-server: heap buffer overflow in devicefocusevent and procxiquerypointer

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-01-18 · updated 2026-06-17
Weakness: CWE-787

Description

A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbitrarily mapped to any value up to 255, but the X.Org Server was only allocating space for the device's particular number of buttons, leading to a heap overflow if a bigger value was used.

Affected products

Debian Linux: 10.0
Fedoraproject Fedora: 39
RedHat Enterprise Linux Desktop: 7.0
RedHat Enterprise Linux Server: 7.0
RedHat Enterprise Linux Workstation: 7.0
xorg-x11-server: before 21.1.11 — fixed in 21.1.11
X.Org xwayland: before 23.2.4 — fixed in 23.2.4

How to fix

Upgrade to a fixed version: xorg-x11-server 21.1.11; X.Org xwayland 23.2.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-6816 or the next vulnerability affects your stack