---
id: CVE-2024-31080
title: 'Xorg-x11-server: heap buffer overread/data leakage in procxigetselectedevents'
summary: >-
  A heap-based buffer over-read vulnerability was found in the X.org server's
  ProcXIGetSelectedEvents() function. This issue occurs when byte-swapped length
  values are used in replies, potentially leading to memory leakage and
  segmentation…
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H'
cvssSource: cna
cwe:
  - CWE-126
vendor: Red Hat
product: xorg-server
affected:
  - xorg-server >= 29.1.0 < *
  - tigervnc (all versions)
  - xorg-x11-server (all versions)
  - tigervnc (all versions)
  - tigervnc (all versions)
  - xorg-x11-server (all versions)
  - tigervnc (all versions)
  - xorg-x11-server-Xwayland (all versions)
  - tigervnc (all versions)
  - tigervnc (all versions)
  - tigervnc (all versions)
  - tigervnc (all versions)
  - tigervnc (all versions)
  - tigervnc (all versions)
  - tigervnc (all versions)
  - tigervnc (all versions)
  - tigervnc (all versions)
  - xorg-x11-server-Xwayland (all versions)
  - xorg-x11-server (all versions)
  - tigervnc (all versions)
  - tigervnc (all versions)
  - tigervnc
  - xorg-x11-server
  - xorg-x11-server-Xwayland
  - xorg-x11-server
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2024-08-07T15:41:05.539453Z'
published: '2024-04-04'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T21:12:25.833Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-31080'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2024:1785'
    label: 'RHSA-2024:1785'
  - url: 'https://access.redhat.com/errata/RHSA-2024:2036'
    label: 'RHSA-2024:2036'
  - url: 'https://access.redhat.com/errata/RHSA-2024:2037'
    label: 'RHSA-2024:2037'
  - url: 'https://access.redhat.com/errata/RHSA-2024:2038'
    label: 'RHSA-2024:2038'
  - url: 'https://access.redhat.com/errata/RHSA-2024:2039'
    label: 'RHSA-2024:2039'
  - url: 'https://access.redhat.com/errata/RHSA-2024:2040'
    label: 'RHSA-2024:2040'
  - url: 'https://access.redhat.com/errata/RHSA-2024:2041'
    label: 'RHSA-2024:2041'
  - url: 'https://access.redhat.com/errata/RHSA-2024:2042'
    label: 'RHSA-2024:2042'
  - url: 'https://access.redhat.com/errata/RHSA-2024:2080'
    label: 'RHSA-2024:2080'
  - url: 'https://access.redhat.com/errata/RHSA-2024:2616'
    label: 'RHSA-2024:2616'
  - url: 'https://access.redhat.com/errata/RHSA-2024:3258'
    label: 'RHSA-2024:3258'
  - url: 'https://access.redhat.com/errata/RHSA-2024:3261'
    label: 'RHSA-2024:3261'
  - url: 'https://access.redhat.com/errata/RHSA-2024:3343'
    label: 'RHSA-2024:3343'
  - url: 'https://access.redhat.com/errata/RHSA-2024:9093'
    label: 'RHSA-2024:9093'
  - url: 'https://access.redhat.com/errata/RHSA-2024:9122'
    label: 'RHSA-2024:9122'
  - url: 'https://access.redhat.com/errata/RHSA-2025:12751'
    label: 'RHSA-2025:12751'
  - url: 'https://access.redhat.com/security/cve/CVE-2024-31080'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2271997'
    label: RHBZ#2271997
tags:
  - cve.org
epss: 0.00517
epssPercentile: 0.44135
ingestedAt: '2026-11-05T21:36:00.602Z'
---

## Overview

A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIGetSelectedEvents() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads.

## Affected

- `xorg-server >= 29.1.0 < *`
- `tigervnc (all versions)`
- `xorg-x11-server (all versions)`
- `tigervnc (all versions)`
- `tigervnc (all versions)`
- `xorg-x11-server (all versions)`
- `tigervnc (all versions)`
- `xorg-x11-server-Xwayland (all versions)`
- `tigervnc (all versions)`
- `tigervnc (all versions)`
- `tigervnc (all versions)`
- `tigervnc (all versions)`
- `tigervnc (all versions)`
- `tigervnc (all versions)`
- `tigervnc (all versions)`
- `tigervnc (all versions)`
- `tigervnc (all versions)`
- `xorg-x11-server-Xwayland (all versions)`
- `xorg-x11-server (all versions)`
- `tigervnc (all versions)`
- `tigervnc (all versions)`
- `tigervnc`
- `xorg-x11-server`
- `xorg-x11-server-Xwayland`
- `xorg-x11-server`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.