# CVE-2024-31082: xnest: A heap-based buffer over-read vulnerability was found in the X.org server'sProcAppleDRICreatePixmap() function

CVE-2024-31082 is fixed in 13 products on 1 platform, first by xdmx 2:1.19.6-1ubuntu4.15+esm7, released March 3, 2024. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2024-31082
- Priority: High
- CVSS: 7.3 (Medium)
- EPSS: 0.0034
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Mar 3, 2024

## Description

A heap-based buffer over-read vulnerability was found in the X.org server'sProcAppleDRICreatePixmap() function. This issue occurs when byte-swappedlength values are used in replies, potentially leading to memory leakageand segmentation faults, particularly when triggered by a client with adifferent endianness. This vulnerability could be exploited by an attackerto cause the X server to read heap memory values and then transmit themback to the client until encountering an unmapped page, resulting in acrash. Despite the attacker's inability to control the specific memorycopied into the replies, the small length values typically stored in a32-bit integer can result in significant attempted out-of-bounds reads.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | xdmx Ubuntu 18.04.6 LTS (bionic) | 2:1.19.6-1ubuntu4.15+esm7 | [xdmx 2:1.19.6-1ubuntu4.15+esm7](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-xdmx-2-1.19.6-1ubuntu4.15-esm7.md) | Mar 3, 2024 |
| Linux | xdmx Ubuntu 20.04 LTS (focal) | 2:1.20.13-1ubuntu1~20.04.16 | [xdmx 2:1.20.13-1ubuntu1~20.04.16](https://patchblox.com/security/data/fix/linux/ubuntu-focal-xdmx-2-1.20.13-1ubuntu1-20.04.16.md) | Mar 3, 2024 |
| Linux | xdmx-tools Ubuntu 18.04.6 LTS (bionic) | 2:1.19.6-1ubuntu4.15+esm7 | [xdmx-tools 2:1.19.6-1ubuntu4.15+esm7](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-xdmx-tools-2-1.19.6-1ubuntu4.15-esm7.md) | Mar 3, 2024 |
| Linux | xdmx-tools Ubuntu 20.04 LTS (focal) | 2:1.20.13-1ubuntu1~20.04.16 | [xdmx-tools 2:1.20.13-1ubuntu1~20.04.16](https://patchblox.com/security/data/fix/linux/ubuntu-focal-xdmx-tools-2-1.20.13-1ubuntu1-20.04.16.md) | Mar 3, 2024 |
| Linux | xmir Ubuntu 18.04.6 LTS (bionic) | 2:1.19.6-1ubuntu4.15+esm7 | [xmir 2:1.19.6-1ubuntu4.15+esm7](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-xmir-2-1.19.6-1ubuntu4.15-esm7.md) | Mar 3, 2024 |
| Linux | xnest Ubuntu 18.04.6 LTS (bionic) | 2:1.19.6-1ubuntu4.15+esm7 | [xnest 2:1.19.6-1ubuntu4.15+esm7](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-xnest-2-1.19.6-1ubuntu4.15-esm7.md) | Mar 3, 2024 |
| Linux | xnest Ubuntu 20.04 LTS (focal) | 2:1.20.13-1ubuntu1~20.04.16 | [xnest 2:1.20.13-1ubuntu1~20.04.16](https://patchblox.com/security/data/fix/linux/ubuntu-focal-xnest-2-1.20.13-1ubuntu1-20.04.16.md) | Mar 3, 2024 |
| Linux | xnest Ubuntu 22.04.1 LTS (jammy) | 2:21.1.4-2ubuntu1.7~22.04.9 | [xnest 2:21.1.4-2ubuntu1.7~22.04.9](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-xnest-2-21.1.4-2ubuntu1.7-22.04.9.md) | Mar 3, 2024 |
| Linux | xnest Ubuntu 24.04.5 LTS (noble) | 2:21.1.12-1ubuntu1 | [xnest 2:21.1.12-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-xnest-2-21.1.12-1ubuntu1.md) | Mar 3, 2024 |
| Linux | xnest Ubuntu 24.10 (oracular) | 2:21.1.12-1ubuntu1 | [xnest 2:21.1.12-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-xnest-2-21.1.12-1ubuntu1.md) | Jan 16, 2026 |
| Linux | xnest Ubuntu 25.04 (plucky) | 2:21.1.12-1ubuntu1 | [xnest 2:21.1.12-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-xnest-2-21.1.12-1ubuntu1.md) | Jan 16, 2026 |
| Linux | xorg-server Debian 12.15 (bookworm) | 2:21.1.7-3+deb12u7 | [DEBIAN-CVE-2024-31082](https://patchblox.com/security/data/fix/linux/debian-cve-2024-31082.md) | Apr 4, 2024 |
| Linux | xorg-server Debian 13.5 (trixie) | 2:21.1.11-3 | [DEBIAN-CVE-2024-31082](https://patchblox.com/security/data/fix/linux/debian-cve-2024-31082.md) | Apr 4, 2024 |
| Linux | xorg-server Debian 14 | 2:21.1.11-3 | [DEBIAN-CVE-2024-31082](https://patchblox.com/security/data/fix/linux/debian-cve-2024-31082.md) | Apr 4, 2024 |
| Linux | xorg-server-source Ubuntu 18.04.6 LTS (bionic) | 2:1.19.6-1ubuntu4.15+esm7 | [xorg-server-source 2:1.19.6-1ubuntu4.15+esm7](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-xorg-server-source-2-1.19.6-1ubuntu4.15-esm7.md) | Mar 3, 2024 |
| Linux | xorg-server-source Ubuntu 20.04 LTS (focal) | 2:1.20.13-1ubuntu1~20.04.16 | [xorg-server-source 2:1.20.13-1ubuntu1~20.04.16](https://patchblox.com/security/data/fix/linux/ubuntu-focal-xorg-server-source-2-1.20.13-1ubuntu1-20.04.16.md) | Mar 3, 2024 |
| Linux | xorg-server-source Ubuntu 22.04.1 LTS (jammy) | 2:21.1.4-2ubuntu1.7~22.04.9 | [xorg-server-source 2:21.1.4-2ubuntu1.7~22.04.9](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-xorg-server-source-2-21.1.4-2ubuntu1.7-22.04.9.md) | Mar 3, 2024 |
| Linux | xorg-server-source Ubuntu 24.04.5 LTS (noble) | 2:21.1.12-1ubuntu1 | [xorg-server-source 2:21.1.12-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-xorg-server-source-2-21.1.12-1ubuntu1.md) | Mar 3, 2024 |
| Linux | xorg-server-source Ubuntu 24.10 (oracular) | 2:21.1.12-1ubuntu1 | [xorg-server-source 2:21.1.12-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-xorg-server-source-2-21.1.12-1ubuntu1.md) | Jan 16, 2026 |
| Linux | xorg-server-source Ubuntu 25.04 (plucky) | 2:21.1.12-1ubuntu1 | [xorg-server-source 2:21.1.12-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-xorg-server-source-2-21.1.12-1ubuntu1.md) | Jan 16, 2026 |
| Linux | xserver-common Ubuntu 18.04.6 LTS (bionic) | 2:1.19.6-1ubuntu4.15+esm7 | [xserver-common 2:1.19.6-1ubuntu4.15+esm7](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-xserver-common-2-1.19.6-1ubuntu4.15-esm7.md) | Mar 3, 2024 |
| Linux | xserver-common Ubuntu 20.04 LTS (focal) | 2:1.20.13-1ubuntu1~20.04.16 | [xserver-common 2:1.20.13-1ubuntu1~20.04.16](https://patchblox.com/security/data/fix/linux/ubuntu-focal-xserver-common-2-1.20.13-1ubuntu1-20.04.16.md) | Mar 3, 2024 |
| Linux | xserver-common Ubuntu 22.04.1 LTS (jammy) | 2:21.1.4-2ubuntu1.7~22.04.9 | [xserver-common 2:21.1.4-2ubuntu1.7~22.04.9](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-xserver-common-2-21.1.4-2ubuntu1.7-22.04.9.md) | Mar 3, 2024 |
| Linux | xserver-common Ubuntu 24.04.5 LTS (noble) | 2:21.1.12-1ubuntu1 | [xserver-common 2:21.1.12-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-xserver-common-2-21.1.12-1ubuntu1.md) | Mar 3, 2024 |
| Linux | xserver-common Ubuntu 24.10 (oracular) | 2:21.1.12-1ubuntu1 | [xserver-common 2:21.1.12-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-xserver-common-2-21.1.12-1ubuntu1.md) | Jan 16, 2026 |
| Linux | xserver-common Ubuntu 25.04 (plucky) | 2:21.1.12-1ubuntu1 | [xserver-common 2:21.1.12-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-xserver-common-2-21.1.12-1ubuntu1.md) | Jan 16, 2026 |
| Linux | xserver-xephyr Ubuntu 18.04.6 LTS (bionic) | 2:1.19.6-1ubuntu4.15+esm7 | [xserver-xephyr 2:1.19.6-1ubuntu4.15+esm7](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-xserver-xephyr-2-1.19.6-1ubuntu4.15-esm7.md) | Mar 3, 2024 |
| Linux | xserver-xephyr Ubuntu 20.04 LTS (focal) | 2:1.20.13-1ubuntu1~20.04.16 | [xserver-xephyr 2:1.20.13-1ubuntu1~20.04.16](https://patchblox.com/security/data/fix/linux/ubuntu-focal-xserver-xephyr-2-1.20.13-1ubuntu1-20.04.16.md) | Mar 3, 2024 |
| Linux | xserver-xephyr Ubuntu 22.04.1 LTS (jammy) | 2:21.1.4-2ubuntu1.7~22.04.9 | [xserver-xephyr 2:21.1.4-2ubuntu1.7~22.04.9](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-xserver-xephyr-2-21.1.4-2ubuntu1.7-22.04.9.md) | Mar 3, 2024 |
| Linux | xserver-xephyr Ubuntu 24.04.5 LTS (noble) | 2:21.1.12-1ubuntu1 | [xserver-xephyr 2:21.1.12-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-xserver-xephyr-2-21.1.12-1ubuntu1.md) | Mar 3, 2024 |
| Linux | xserver-xephyr Ubuntu 24.10 (oracular) | 2:21.1.12-1ubuntu1 | [xserver-xephyr 2:21.1.12-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-xserver-xephyr-2-21.1.12-1ubuntu1.md) | Jan 16, 2026 |
| Linux | xserver-xephyr Ubuntu 25.04 (plucky) | 2:21.1.12-1ubuntu1 | [xserver-xephyr 2:21.1.12-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-xserver-xephyr-2-21.1.12-1ubuntu1.md) | Jan 16, 2026 |
| Linux | xserver-xorg-core Ubuntu 18.04.6 LTS (bionic) | 2:1.19.6-1ubuntu4.15+esm7 | [xserver-xorg-core 2:1.19.6-1ubuntu4.15+esm7](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-xserver-xorg-core-2-1.19.6-1ubuntu4.15-esm7.md) | Mar 3, 2024 |
| Linux | xserver-xorg-core Ubuntu 20.04 LTS (focal) | 2:1.20.13-1ubuntu1~20.04.16 | [xserver-xorg-core 2:1.20.13-1ubuntu1~20.04.16](https://patchblox.com/security/data/fix/linux/ubuntu-focal-xserver-xorg-core-2-1.20.13-1ubuntu1-20.04.16.md) | Mar 3, 2024 |
| Linux | xserver-xorg-core Ubuntu 22.04.1 LTS (jammy) | 2:21.1.4-2ubuntu1.7~22.04.9 | [xserver-xorg-core 2:21.1.4-2ubuntu1.7~22.04.9](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-xserver-xorg-core-2-21.1.4-2ubuntu1.7-22.04.9.md) | Mar 3, 2024 |
| Linux | xserver-xorg-core Ubuntu 24.04.5 LTS (noble) | 2:21.1.12-1ubuntu1 | [xserver-xorg-core 2:21.1.12-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-xserver-xorg-core-2-21.1.12-1ubuntu1.md) | Mar 3, 2024 |
| Linux | xserver-xorg-core Ubuntu 24.10 (oracular) | 2:21.1.12-1ubuntu1 | [xserver-xorg-core 2:21.1.12-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-xserver-xorg-core-2-21.1.12-1ubuntu1.md) | Jan 16, 2026 |
| Linux | xserver-xorg-core Ubuntu 25.04 (plucky) | 2:21.1.12-1ubuntu1 | [xserver-xorg-core 2:21.1.12-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-xserver-xorg-core-2-21.1.12-1ubuntu1.md) | Jan 16, 2026 |
| Linux | xserver-xorg-legacy Ubuntu 18.04.6 LTS (bionic) | 2:1.19.6-1ubuntu4.15+esm7 | [xserver-xorg-legacy 2:1.19.6-1ubuntu4.15+esm7](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-xserver-xorg-legacy-2-1.19.6-1ubuntu4.15-esm7.md) | Mar 3, 2024 |
| Linux | xserver-xorg-legacy Ubuntu 20.04 LTS (focal) | 2:1.20.13-1ubuntu1~20.04.16 | [xserver-xorg-legacy 2:1.20.13-1ubuntu1~20.04.16](https://patchblox.com/security/data/fix/linux/ubuntu-focal-xserver-xorg-legacy-2-1.20.13-1ubuntu1-20.04.16.md) | Mar 3, 2024 |
| Linux | xserver-xorg-legacy Ubuntu 22.04.1 LTS (jammy) | 2:21.1.4-2ubuntu1.7~22.04.9 | [xserver-xorg-legacy 2:21.1.4-2ubuntu1.7~22.04.9](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-xserver-xorg-legacy-2-21.1.4-2ubuntu1.7-22.04.9.md) | Mar 3, 2024 |
| Linux | xserver-xorg-legacy Ubuntu 24.04.5 LTS (noble) | 2:21.1.12-1ubuntu1 | [xserver-xorg-legacy 2:21.1.12-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-xserver-xorg-legacy-2-21.1.12-1ubuntu1.md) | Mar 3, 2024 |
| Linux | xserver-xorg-legacy Ubuntu 24.10 (oracular) | 2:21.1.12-1ubuntu1 | [xserver-xorg-legacy 2:21.1.12-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-xserver-xorg-legacy-2-21.1.12-1ubuntu1.md) | Jan 16, 2026 |
| Linux | xserver-xorg-legacy Ubuntu 25.04 (plucky) | 2:21.1.12-1ubuntu1 | [xserver-xorg-legacy 2:21.1.12-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-xserver-xorg-legacy-2-21.1.12-1ubuntu1.md) | Jan 16, 2026 |
| Linux | xserver-xorg-xmir Ubuntu 18.04.6 LTS (bionic) | 2:1.19.6-1ubuntu4.15+esm7 | [xserver-xorg-xmir 2:1.19.6-1ubuntu4.15+esm7](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-xserver-xorg-xmir-2-1.19.6-1ubuntu4.15-esm7.md) | Mar 3, 2024 |
| Linux | xvfb Ubuntu 18.04.6 LTS (bionic) | 2:1.19.6-1ubuntu4.15+esm7 | [xvfb 2:1.19.6-1ubuntu4.15+esm7](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-xvfb-2-1.19.6-1ubuntu4.15-esm7.md) | Mar 3, 2024 |
| Linux | xvfb Ubuntu 20.04 LTS (focal) | 2:1.20.13-1ubuntu1~20.04.16 | [xvfb 2:1.20.13-1ubuntu1~20.04.16](https://patchblox.com/security/data/fix/linux/ubuntu-focal-xvfb-2-1.20.13-1ubuntu1-20.04.16.md) | Mar 3, 2024 |
| Linux | xvfb Ubuntu 22.04.1 LTS (jammy) | 2:21.1.4-2ubuntu1.7~22.04.9 | [xvfb 2:21.1.4-2ubuntu1.7~22.04.9](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-xvfb-2-21.1.4-2ubuntu1.7-22.04.9.md) | Mar 3, 2024 |
| Linux | xvfb Ubuntu 24.04.5 LTS (noble) | 2:21.1.12-1ubuntu1 | [xvfb 2:21.1.12-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-xvfb-2-21.1.12-1ubuntu1.md) | Mar 3, 2024 |
| Linux | xvfb Ubuntu 24.10 (oracular) | 2:21.1.12-1ubuntu1 | [xvfb 2:21.1.12-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-xvfb-2-21.1.12-1ubuntu1.md) | Jan 16, 2026 |
| Linux | xvfb Ubuntu 25.04 (plucky) | 2:21.1.12-1ubuntu1 | [xvfb 2:21.1.12-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-xvfb-2-21.1.12-1ubuntu1.md) | Jan 16, 2026 |
| Linux | xwayland Ubuntu 18.04.6 LTS (bionic) | 2:1.19.6-1ubuntu4.15+esm7 | [xwayland 2:1.19.6-1ubuntu4.15+esm7](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-xwayland-2-1.19.6-1ubuntu4.15-esm7.md) | Mar 3, 2024 |
| Linux | xwayland Ubuntu 20.04 LTS (focal) | 2:1.20.13-1ubuntu1~20.04.16 | [xwayland 2:1.20.13-1ubuntu1~20.04.16](https://patchblox.com/security/data/fix/linux/ubuntu-focal-xwayland-2-1.20.13-1ubuntu1-20.04.16.md) | Mar 3, 2024 |
| Linux | xwayland Ubuntu 22.04.1 LTS (jammy) | 2:22.1.1-1ubuntu0.12 | [xwayland 2:22.1.1-1ubuntu0.12](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-xwayland-2-22.1.1-1ubuntu0.12.md) | Mar 3, 2024 |

---

Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.