CVE-2024-0409 is a high severity (CVSS 7.8) memory write flaw in the X.Org server. The cursor code in Xephyr and Xwayland uses the wrong type of private data, which overwrites the SELinux context. Red Hat rates it Moderate. Apply your distribution update.
What's affected
The record names the X.Org server, Xwayland and TigerVNC, with Fedora 39 as an affected operating system entry. The description says the cursor code in both Xephyr and Xwayland uses the wrong type of private at creation: it uses the cursor bits type with the cursor as private, and initiating the cursor overwrites the XSELINUX context.
The record gives no version range. Red Hat's CVE page references several errata for it, RHSA-2024:0320, RHSA-2024:2169, RHSA-2024:2170, RHSA-2024:2995 and RHSA-2024:2996. We did not open each one, so read them for the fixed package build on your release.
The weakness is CWE-787, out-of-bounds write. The vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H: local, low complexity, low privileges.
Source conflict to note: the CVSS base score is 7.8 (high) in both the record and Red Hat's page, but Red Hat rates the impact Moderate on Red Hat Enterprise Linux 8 and 9. Its statement says the Xorg server does not run with root privileges there. Both are true and describe different things, the generic score and the effect on that platform. It is not on the CISA Known Exploited Vulnerabilities list.
How to check if you're exposed
Check the installed packages on the machine.
On RPM based systems:
rpm -q xorg-x11-server-Xephyr xorg-x11-server-Xwayland
On Debian based systems:
dpkg -l | grep -E 'xwayland|xserver-xephyr'
If a package is installed, compare its version with your distribution's security notice for this CVE. Servers without a graphical session usually have none of these packages, and containers often do not either. Also check for desktop sessions that run Xwayland, which is common on current desktops.
What to do now
- List machines with Xwayland, Xephyr or an X.Org server installed, desktops and shared build hosts first.
- Apply the vendor update, using the errata linked above for Red Hat systems.
- Remove Xephyr from machines that do not need it.
- Red Hat says no mitigation meets its criteria, so patching is the path.
- Log out and restart graphical sessions after the update so the new server binary is the one running.
Why it matters
The attacker model is local. Someone needs to run code on the machine first, so this matters most on shared workstations, remote desktop hosts and developer machines. The bug mixes up two kinds of private data in the cursor code, so a write meant for one structure lands on another, here the SELinux context. Memory safety flaws like this can corrupt state in ways that depend on layout, and the advisory does not describe a specific outcome beyond the overwrite.
Quick check
Why does Red Hat call this Moderate when the score is 7.8?
Red Hat says the Xorg server does not run with root privileges in Red Hat Enterprise Linux 8 and 9, so it rated the impact Moderate there.
Is there a workaround for CVE-2024-0409?
Red Hat says mitigation is either not available or does not meet its criteria. Apply the vendor update.
Sources
Last reviewed: 19 October 2026.
