CVE-2024-31083High· 7.8▾ TwilightA use-after-free vulnerability was found in the ProcRenderAddGlyphs() function of Xorg servers. This issue occurs when AllocateGlyph() is called to store new glyphs sent by the client to the X server, potentially resulting in multiple en…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.9 · likelihood 0.4 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
1.9%
A use-after-free vulnerability was found in the ProcRenderAddGlyphs() function of Xorg servers. This issue occurs when AllocateGlyph() is called to store new glyphs sent by the client to the X server, potentially resulting in multiple entries pointing to the same non-refcounted glyphs. Consequently, ProcRenderAddGlyphs() may free a glyph, leading to a use-after-free scenario when the same glyph pointer is subsequently accessed. This flaw allows an authenticated attacker to execute arbitrary code on the system by sending a specially crafted request.
xorg-x11-server 21.1.12tigervnc (all versions)xorg-x11-server (all versions)tigervnc (all versions)tigervnc (all versions)xorg-x11-server (all versions)tigervnc (all versions)xorg-x11-server-Xwayland (all versions)tigervnc (all versions)tigervnc (all versions)tigervnc (all versions)tigervnc (all versions)tigervnc (all versions)tigervnc (all versions)tigervnc (all versions)tigervnc (all versions)tigervnc (all versions)xorg-x11-server-Xwayland (all versions)xorg-x11-server (all versions)tigervnc (all versions)tigervnc (all versions)tigervncxorg-x11-serverxorg-x11-server-Xwaylandxorg-x11-serverRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-93515Medium· 6.8.Org Server Present Extension Use-After-Free
CVE-2026-93516Medium· 5.5.Org Server XInput Passive Grab Use-After-Free
CVE-2026-93522High· 7.8X.Org Server Glamor CopyArea Heap Buffer Overflow
CVE-2026-93523High· 7.8X.Org Server XInput2 PassiveUngrabDevice Out-of-Bounds Write
CVE-2026-93524Medium· 6.9X.Org Server XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read
CVE-2026-93536Medium· 5.3X.Org Server GestureBuildSprite Use-After-Free