{"id":"CVE-2024-31082","title":"Xorg-x11-server: heap buffer overread/data leakage in procappledricreatepixmap","summary":"A heap-based buffer over-read vulnerability was found in the X.org server's ProcAppleDRICreatePixmap() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentatio…","severity":"high","cvss":7.3,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H","cvssSource":"cna","cwe":["CWE-126"],"vendor":"Red Hat","product":"xorg-server","affected":["xorg-server >= 1.12.0 < 21.1.12","tigervnc","xorg-x11-server","xorg-x11-server-Xwayland","tigervnc","xorg-x11-server","tigervnc","xorg-x11-server","tigervnc","xorg-x11-server","xorg-x11-server-Xwayland","tigervnc","xorg-x11-server","xorg-x11-server-Xwayland"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2024-07-29T15:13:28.884475Z"},"published":"2024-04-04","updated":"2026-11-04","sourceUpdated":"2026-11-04T21:12:30.148Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-31082","references":[{"url":"https://access.redhat.com/security/cve/CVE-2024-31082"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2271999","label":"RHBZ#2271999"},{"url":"https://lists.x.org/archives/xorg-announce/2024-April/003497.html"}],"tags":["cve.org"],"epss":0.00338,"epssPercentile":0.2739,"ingestedAt":"2026-11-05T21:36:00.606Z","slug":"CVE-2024-31082","body":"## Overview\n\nA heap-based buffer over-read vulnerability was found in the X.org server's ProcAppleDRICreatePixmap() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads.\n\n## Affected\n\n- `xorg-server >= 1.12.0 < 21.1.12`\n- `tigervnc`\n- `xorg-x11-server`\n- `xorg-x11-server-Xwayland`\n- `tigervnc`\n- `xorg-x11-server`\n- `tigervnc`\n- `xorg-x11-server`\n- `tigervnc`\n- `xorg-x11-server`\n- `xorg-x11-server-Xwayland`\n- `tigervnc`\n- `xorg-x11-server`\n- `xorg-x11-server-Xwayland`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":40.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}