Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-fgnr-h7rm-83d4
Vulnerability ID VCID-fgnr-h7rm-83d4
Aliases CVE-2024-0409
Summary Multiple vulnerabilities have been discovered in the Xorg Server and XWayland, the worst of which can result in privilege escalation or remote code execution.
Status Published
Exploitability 0.5
Weighted Severity 7.0
Risk 3.5
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-787 Out-of-bounds Write
System Score Found at
cvssv3.1 7.8 https://access.redhat.com/errata/RHSA-2024:0320
ssvc Track https://access.redhat.com/errata/RHSA-2024:0320
cvssv3.1 7.8 https://access.redhat.com/errata/RHSA-2024:2169
ssvc Track https://access.redhat.com/errata/RHSA-2024:2169
cvssv3.1 7.8 https://access.redhat.com/errata/RHSA-2024:2170
ssvc Track https://access.redhat.com/errata/RHSA-2024:2170
cvssv3.1 7.8 https://access.redhat.com/errata/RHSA-2024:2995
ssvc Track https://access.redhat.com/errata/RHSA-2024:2995
cvssv3.1 7.8 https://access.redhat.com/errata/RHSA-2024:2996
ssvc Track https://access.redhat.com/errata/RHSA-2024:2996
cvssv3 7.8 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-0409.json
cvssv3.1 7.8 https://access.redhat.com/security/cve/CVE-2024-0409
ssvc Track https://access.redhat.com/security/cve/CVE-2024-0409
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2024-0409
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2024-0409
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2024-0409
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2024-0409
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2024-0409
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2024-0409
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2024-0409
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2024-0409
cvssv3.1 7.8 https://bugzilla.redhat.com/show_bug.cgi?id=2257690
ssvc Track https://bugzilla.redhat.com/show_bug.cgi?id=2257690
cvssv3.1 5.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-0409.json
https://api.first.org/data/v1/epss?cve=CVE-2024-0409
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6816
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-0229
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-0408
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-0409
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21885
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21886
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
2257690 https://bugzilla.redhat.com/show_bug.cgi?id=2257690
cpe:/a:redhat:enterprise_linux:8::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:enterprise_linux:8::appstream
cpe:/a:redhat:enterprise_linux:8::crb https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:enterprise_linux:8::crb
cpe:/a:redhat:enterprise_linux:9::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/a:redhat:enterprise_linux:9::crb https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:enterprise_linux:9::crb
cpe:/o:redhat:enterprise_linux:6 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:7::client https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:7::client
cpe:/o:redhat:enterprise_linux:7::computenode https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:7::computenode
cpe:/o:redhat:enterprise_linux:7::server https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:7::server
cpe:/o:redhat:enterprise_linux:7::workstation https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:7::workstation
cpe:/o:redhat:enterprise_linux:8 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:9
CVE-2024-0409 https://access.redhat.com/security/cve/CVE-2024-0409
GLSA-202401-30 https://security.gentoo.org/glsa/202401-30
RHSA-2024:0320 https://access.redhat.com/errata/RHSA-2024:0320
RHSA-2024:2169 https://access.redhat.com/errata/RHSA-2024:2169
RHSA-2024:2170 https://access.redhat.com/errata/RHSA-2024:2170
RHSA-2024:2995 https://access.redhat.com/errata/RHSA-2024:2995
RHSA-2024:2996 https://access.redhat.com/errata/RHSA-2024:2996
USN-6587-1 https://usn.ubuntu.com/6587-1/
USN-6587-2 https://usn.ubuntu.com/6587-2/
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2024:0320
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-01-18T16:47:29Z/ Found at https://access.redhat.com/errata/RHSA-2024:0320
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2024:2169
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-01-18T16:47:29Z/ Found at https://access.redhat.com/errata/RHSA-2024:2169
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2024:2170
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-01-18T16:47:29Z/ Found at https://access.redhat.com/errata/RHSA-2024:2170
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2024:2995
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-01-18T16:47:29Z/ Found at https://access.redhat.com/errata/RHSA-2024:2995
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2024:2996
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-01-18T16:47:29Z/ Found at https://access.redhat.com/errata/RHSA-2024:2996
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-0409.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/security/cve/CVE-2024-0409
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-01-18T16:47:29Z/ Found at https://access.redhat.com/security/cve/CVE-2024-0409
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://bugzilla.redhat.com/show_bug.cgi?id=2257690
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-01-18T16:47:29Z/ Found at https://bugzilla.redhat.com/show_bug.cgi?id=2257690
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.0478
EPSS Score 0.00018
Published At April 2, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:03:25.671558+00:00 Gentoo Importer Import https://security.gentoo.org/glsa/202401-30 38.0.0