---
id: CVE-2024-31082
title: 'Xorg-x11-server: heap buffer overread/data leakage in procappledricreatepixmap'
summary: >-
  A heap-based buffer over-read vulnerability was found in the X.org server's
  ProcAppleDRICreatePixmap() function. This issue occurs when byte-swapped
  length values are used in replies, potentially leading to memory leakage and
  segmentatio…
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H'
cvssSource: cna
cwe:
  - CWE-126
vendor: Red Hat
product: xorg-server
affected:
  - xorg-server >= 1.12.0 < 21.1.12
  - tigervnc
  - xorg-x11-server
  - xorg-x11-server-Xwayland
  - tigervnc
  - xorg-x11-server
  - tigervnc
  - xorg-x11-server
  - tigervnc
  - xorg-x11-server
  - xorg-x11-server-Xwayland
  - tigervnc
  - xorg-x11-server
  - xorg-x11-server-Xwayland
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-07-29T15:13:28.884475Z'
published: '2024-04-04'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T21:12:30.148Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-31082'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2024-31082'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2271999'
    label: RHBZ#2271999
  - url: 'https://lists.x.org/archives/xorg-announce/2024-April/003497.html'
tags:
  - cve.org
epss: 0.00338
epssPercentile: 0.2739
ingestedAt: '2026-11-05T21:36:00.606Z'
---

## Overview

A heap-based buffer over-read vulnerability was found in the X.org server's ProcAppleDRICreatePixmap() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads.

## Affected

- `xorg-server >= 1.12.0 < 21.1.12`
- `tigervnc`
- `xorg-x11-server`
- `xorg-x11-server-Xwayland`
- `tigervnc`
- `xorg-x11-server`
- `tigervnc`
- `xorg-x11-server`
- `tigervnc`
- `xorg-x11-server`
- `xorg-x11-server-Xwayland`
- `tigervnc`
- `xorg-x11-server`
- `xorg-x11-server-Xwayland`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.