Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-v9p1-8sb6-9ufr
Vulnerability ID VCID-v9p1-8sb6-9ufr
Aliases CVE-2024-21885
Summary Multiple vulnerabilities have been discovered in the Xorg Server and XWayland, the worst of which can result in privilege escalation or remote code execution.
Status Published
Exploitability 0.5
Weighted Severity 7.0
Risk 3.5
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-122 Heap-based Buffer Overflow
System Score Found at
cvssv3.1 7.8 https://access.redhat.com/errata/RHSA-2024:0320
ssvc Track https://access.redhat.com/errata/RHSA-2024:0320
cvssv3.1 7.8 https://access.redhat.com/errata/RHSA-2024:0557
ssvc Track https://access.redhat.com/errata/RHSA-2024:0557
cvssv3.1 7.8 https://access.redhat.com/errata/RHSA-2024:0558
ssvc Track https://access.redhat.com/errata/RHSA-2024:0558
cvssv3.1 7.8 https://access.redhat.com/errata/RHSA-2024:0597
ssvc Track https://access.redhat.com/errata/RHSA-2024:0597
cvssv3.1 7.8 https://access.redhat.com/errata/RHSA-2024:0607
ssvc Track https://access.redhat.com/errata/RHSA-2024:0607
cvssv3.1 7.8 https://access.redhat.com/errata/RHSA-2024:0614
ssvc Track https://access.redhat.com/errata/RHSA-2024:0614
cvssv3.1 7.8 https://access.redhat.com/errata/RHSA-2024:0617
ssvc Track https://access.redhat.com/errata/RHSA-2024:0617
cvssv3.1 7.8 https://access.redhat.com/errata/RHSA-2024:0621
ssvc Track https://access.redhat.com/errata/RHSA-2024:0621
cvssv3.1 7.8 https://access.redhat.com/errata/RHSA-2024:0626
ssvc Track https://access.redhat.com/errata/RHSA-2024:0626
cvssv3.1 7.8 https://access.redhat.com/errata/RHSA-2024:0629
ssvc Track https://access.redhat.com/errata/RHSA-2024:0629
cvssv3.1 7.8 https://access.redhat.com/errata/RHSA-2024:2169
ssvc Track https://access.redhat.com/errata/RHSA-2024:2169
cvssv3.1 7.8 https://access.redhat.com/errata/RHSA-2024:2170
ssvc Track https://access.redhat.com/errata/RHSA-2024:2170
cvssv3.1 7.8 https://access.redhat.com/errata/RHSA-2024:2995
ssvc Track https://access.redhat.com/errata/RHSA-2024:2995
cvssv3.1 7.8 https://access.redhat.com/errata/RHSA-2024:2996
ssvc Track https://access.redhat.com/errata/RHSA-2024:2996
cvssv3.1 7.8 https://access.redhat.com/errata/RHSA-2025:12751
ssvc Track https://access.redhat.com/errata/RHSA-2025:12751
cvssv3 7.8 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-21885.json
cvssv3.1 7.8 https://access.redhat.com/security/cve/CVE-2024-21885
ssvc Track https://access.redhat.com/security/cve/CVE-2024-21885
epss 0.0026 https://api.first.org/data/v1/epss?cve=CVE-2024-21885
epss 0.0026 https://api.first.org/data/v1/epss?cve=CVE-2024-21885
epss 0.0026 https://api.first.org/data/v1/epss?cve=CVE-2024-21885
epss 0.0026 https://api.first.org/data/v1/epss?cve=CVE-2024-21885
epss 0.0026 https://api.first.org/data/v1/epss?cve=CVE-2024-21885
epss 0.0026 https://api.first.org/data/v1/epss?cve=CVE-2024-21885
epss 0.0026 https://api.first.org/data/v1/epss?cve=CVE-2024-21885
cvssv3.1 7.8 https://bugzilla.redhat.com/show_bug.cgi?id=2256540
ssvc Track https://bugzilla.redhat.com/show_bug.cgi?id=2256540
cvssv3.1 8.4 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-21885.json
https://api.first.org/data/v1/epss?cve=CVE-2024-21885
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6816
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-0229
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-0408
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-0409
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21885
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21886
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
2256540 https://bugzilla.redhat.com/show_bug.cgi?id=2256540
cpe:/a:redhat:enterprise_linux:8::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:enterprise_linux:8::appstream
cpe:/a:redhat:enterprise_linux:8::crb https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:enterprise_linux:8::crb
cpe:/a:redhat:enterprise_linux:9::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/a:redhat:enterprise_linux:9::crb https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:enterprise_linux:9::crb
cpe:/a:redhat:rhel_aus:8.2::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:rhel_aus:8.2::appstream
cpe:/a:redhat:rhel_aus:8.4::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:rhel_aus:8.4::appstream
cpe:/a:redhat:rhel_e4s:8.2::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:rhel_e4s:8.2::appstream
cpe:/a:redhat:rhel_e4s:8.4::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:rhel_e4s:8.4::appstream
cpe:/a:redhat:rhel_eus:8.6::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:rhel_eus:8.6::appstream
cpe:/a:redhat:rhel_eus:8.8::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:rhel_eus:8.8::appstream
cpe:/a:redhat:rhel_eus:9.0::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:rhel_eus:9.0::appstream
cpe:/a:redhat:rhel_eus:9.2::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:rhel_eus:9.2::appstream
cpe:/a:redhat:rhel_tus:8.2::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:rhel_tus:8.2::appstream
cpe:/a:redhat:rhel_tus:8.4::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:rhel_tus:8.4::appstream
cpe:/o:redhat:enterprise_linux:6 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7::client https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:7::client
cpe:/o:redhat:enterprise_linux:7::computenode https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:7::computenode
cpe:/o:redhat:enterprise_linux:7::server https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:7::server
cpe:/o:redhat:enterprise_linux:7::workstation https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:7::workstation
cpe:/o:redhat:rhel_els:6 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:rhel_els:6
CVE-2024-21885 https://access.redhat.com/security/cve/CVE-2024-21885
GLSA-202401-30 https://security.gentoo.org/glsa/202401-30
RHSA-2024:0320 https://access.redhat.com/errata/RHSA-2024:0320
RHSA-2024:0557 https://access.redhat.com/errata/RHSA-2024:0557
RHSA-2024:0558 https://access.redhat.com/errata/RHSA-2024:0558
RHSA-2024:0597 https://access.redhat.com/errata/RHSA-2024:0597
RHSA-2024:0607 https://access.redhat.com/errata/RHSA-2024:0607
RHSA-2024:0614 https://access.redhat.com/errata/RHSA-2024:0614
RHSA-2024:0617 https://access.redhat.com/errata/RHSA-2024:0617
RHSA-2024:0621 https://access.redhat.com/errata/RHSA-2024:0621
RHSA-2024:0626 https://access.redhat.com/errata/RHSA-2024:0626
RHSA-2024:0629 https://access.redhat.com/errata/RHSA-2024:0629
RHSA-2024:2169 https://access.redhat.com/errata/RHSA-2024:2169
RHSA-2024:2170 https://access.redhat.com/errata/RHSA-2024:2170
RHSA-2024:2995 https://access.redhat.com/errata/RHSA-2024:2995
RHSA-2024:2996 https://access.redhat.com/errata/RHSA-2024:2996
RHSA-2025:12751 https://access.redhat.com/errata/RHSA-2025:12751
USN-6587-1 https://usn.ubuntu.com/6587-1/
USN-6587-2 https://usn.ubuntu.com/6587-2/
USN-6587-5 https://usn.ubuntu.com/6587-5/
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2024:0320
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-04-26T16:17:45Z/ Found at https://access.redhat.com/errata/RHSA-2024:0320
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2024:0557
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-04-26T16:17:45Z/ Found at https://access.redhat.com/errata/RHSA-2024:0557
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2024:0558
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-04-26T16:17:45Z/ Found at https://access.redhat.com/errata/RHSA-2024:0558
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2024:0597
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-04-26T16:17:45Z/ Found at https://access.redhat.com/errata/RHSA-2024:0597
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2024:0607
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-04-26T16:17:45Z/ Found at https://access.redhat.com/errata/RHSA-2024:0607
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2024:0614
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-04-26T16:17:45Z/ Found at https://access.redhat.com/errata/RHSA-2024:0614
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2024:0617
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-04-26T16:17:45Z/ Found at https://access.redhat.com/errata/RHSA-2024:0617
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2024:0621
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-04-26T16:17:45Z/ Found at https://access.redhat.com/errata/RHSA-2024:0621
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2024:0626
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-04-26T16:17:45Z/ Found at https://access.redhat.com/errata/RHSA-2024:0626
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2024:0629
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-04-26T16:17:45Z/ Found at https://access.redhat.com/errata/RHSA-2024:0629
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2024:2169
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-04-26T16:17:45Z/ Found at https://access.redhat.com/errata/RHSA-2024:2169
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2024:2170
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-04-26T16:17:45Z/ Found at https://access.redhat.com/errata/RHSA-2024:2170
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2024:2995
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-04-26T16:17:45Z/ Found at https://access.redhat.com/errata/RHSA-2024:2995
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2024:2996
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-04-26T16:17:45Z/ Found at https://access.redhat.com/errata/RHSA-2024:2996
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2025:12751
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-04-26T16:17:45Z/ Found at https://access.redhat.com/errata/RHSA-2025:12751
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-21885.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/security/cve/CVE-2024-21885
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-04-26T16:17:45Z/ Found at https://access.redhat.com/security/cve/CVE-2024-21885
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://bugzilla.redhat.com/show_bug.cgi?id=2256540
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-04-26T16:17:45Z/ Found at https://bugzilla.redhat.com/show_bug.cgi?id=2256540
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.49268
EPSS Score 0.0026
Published At April 2, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:03:25.689725+00:00 Gentoo Importer Import https://security.gentoo.org/glsa/202401-30 38.0.0