---
id: CVE-2023-6816
title: >-
  Xorg-x11-server: heap buffer overflow in devicefocusevent and
  procxiquerypointer
summary: >-
  A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer
  reply contain a bit for each logical button currently down. Buttons can be
  arbitrarily mapped to any value up to 255, but the X.Org Server was only
  allocating…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-787
vendor: Red Hat
product: tigervnc
affected:
  - tigervnc (all versions)
  - xorg-x11-server (all versions)
  - tigervnc (all versions)
  - tigervnc (all versions)
  - xorg-x11-server (all versions)
  - xorg-x11-server-Xwayland (all versions)
  - tigervnc (all versions)
  - tigervnc (all versions)
  - tigervnc (all versions)
  - tigervnc (all versions)
  - tigervnc (all versions)
  - tigervnc (all versions)
  - tigervnc (all versions)
  - tigervnc (all versions)
  - tigervnc (all versions)
  - xorg-x11-server (all versions)
  - xorg-x11-server-Xwayland (all versions)
  - tigervnc (all versions)
  - tigervnc (all versions)
  - xorg-x11-server
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-01-18T14:05:47.630340Z'
published: '2024-01-18'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T21:07:07.769Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-6816'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2024:0320'
    label: 'RHSA-2024:0320'
  - url: 'https://access.redhat.com/errata/RHSA-2024:0557'
    label: 'RHSA-2024:0557'
  - url: 'https://access.redhat.com/errata/RHSA-2024:0558'
    label: 'RHSA-2024:0558'
  - url: 'https://access.redhat.com/errata/RHSA-2024:0597'
    label: 'RHSA-2024:0597'
  - url: 'https://access.redhat.com/errata/RHSA-2024:0607'
    label: 'RHSA-2024:0607'
  - url: 'https://access.redhat.com/errata/RHSA-2024:0614'
    label: 'RHSA-2024:0614'
  - url: 'https://access.redhat.com/errata/RHSA-2024:0617'
    label: 'RHSA-2024:0617'
  - url: 'https://access.redhat.com/errata/RHSA-2024:0621'
    label: 'RHSA-2024:0621'
  - url: 'https://access.redhat.com/errata/RHSA-2024:0626'
    label: 'RHSA-2024:0626'
  - url: 'https://access.redhat.com/errata/RHSA-2024:0629'
    label: 'RHSA-2024:0629'
  - url: 'https://access.redhat.com/errata/RHSA-2024:2169'
    label: 'RHSA-2024:2169'
  - url: 'https://access.redhat.com/errata/RHSA-2024:2170'
    label: 'RHSA-2024:2170'
  - url: 'https://access.redhat.com/errata/RHSA-2024:2995'
    label: 'RHSA-2024:2995'
  - url: 'https://access.redhat.com/errata/RHSA-2024:2996'
    label: 'RHSA-2024:2996'
  - url: 'https://access.redhat.com/errata/RHSA-2025:12751'
    label: 'RHSA-2025:12751'
  - url: 'https://access.redhat.com/security/cve/CVE-2023-6816'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2257691'
    label: RHBZ#2257691
tags:
  - cve.org
epss: 0.02106
epssPercentile: 0.81807
ingestedAt: '2026-11-05T21:36:00.595Z'
---

## Overview

A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbitrarily mapped to any value up to 255, but the X.Org Server was only allocating space for the device's particular number of buttons, leading to a heap overflow if a bigger value was used.

## Affected

- `tigervnc (all versions)`
- `xorg-x11-server (all versions)`
- `tigervnc (all versions)`
- `tigervnc (all versions)`
- `xorg-x11-server (all versions)`
- `xorg-x11-server-Xwayland (all versions)`
- `tigervnc (all versions)`
- `tigervnc (all versions)`
- `tigervnc (all versions)`
- `tigervnc (all versions)`
- `tigervnc (all versions)`
- `tigervnc (all versions)`
- `tigervnc (all versions)`
- `tigervnc (all versions)`
- `tigervnc (all versions)`
- `xorg-x11-server (all versions)`
- `xorg-x11-server-Xwayland (all versions)`
- `tigervnc (all versions)`
- `tigervnc (all versions)`
- `xorg-x11-server`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.