CVE-2022-46341

Deeper analysis

A vulnerability was found in X.Org where the handler for the XIPassiveUngrab request accesses out-of-bounds memory when invoked with a high keycode or button code. This flaw affects the X server component and is tracked under CWE-787. It carries a CVSS score of 8.8 and can result in local privilege elevation on systems where the X server runs with elevated privileges, as well as remote code execution in ssh X forwarding sessions.

An attacker with the ability to send crafted X requests, such as a local user on a privileged X server or a remote party in an ssh X forwarding scenario, can trigger the out-of-bounds access to achieve code execution or privilege escalation. The issue stems directly from insufficient bounds checking in the request handler.

Advisories from Red Hat and Fedora distributions reference the CVE and provide package updates to address the flaw, with notifications distributed through their respective security lists and bug trackers.

The EPSS score for this CVE rose materially from a low baseline to a peak of 0.3933 on 2025-01-22 before receding, indicating that exploitation interest emerged well after initial disclosure and that the issue warrants renewed attention.