high 8.8

CVE-2022-46341 json

A vulnerability was found in X.Org.

published 2022-12-14 3y ago modified 2026-06-17 4mo ago also EUVD-2022-49157

cvss: 8.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 2.7%; EPSS 2.7% chance of exploitation in 30 days, percentile 86%
public exploits: 0; none known

A vulnerability was found in X.Org. This security flaw occurs because the handler for the XIPassiveUngrab request accesses out-of-bounds memory when invoked with a high keycode or button code. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions.

Patch / fix

distros 7

debian ubuntu red hat suse opensuse almalinux alpine

xwayland Debian 14, Debian 13, Debian 12 2:22.1.6-1
xorg-server Debian 14, Debian 13, Debian 12 2:21.1.5-1

debian advisories DEBIAN-CVE-2022-46341

xwayland Ubuntu 22.04 LTS 2:22.1.1-1ubuntu0.4
xorg-server Ubuntu 18.04 LTS 2:1.19.6-1ubuntu4.13
xorg-server Ubuntu 20.04 LTS 2:1.20.13-1ubuntu1~20.04.5
xorg-server Ubuntu 22.04 LTS 2:21.1.3-2ubuntu2.5
xorg-server-hwe-18.04 Ubuntu 18.04 LTS 2:1.20.8-2ubuntu2.2~18.04.9
xorg-server Ubuntu Pro 14.04 LTS 2:1.15.1-0ubuntu2.11+esm7
xorg-server Ubuntu Pro 16.04 LTS 2:1.18.4-0ubuntu0.12+esm5
xorg-server-hwe-16.04 Ubuntu Pro 16.04 LTS 2:1.19.6-1ubuntu4.1~16.04.6+esm4

ubuntu advisories UBUNTU-CVE-2022-46341

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

tigervnc RHEL 8 1.12.0-15.el8_8
tigervnc-icons RHEL 8 1.12.0-15.el8_8
tigervnc-server RHEL 8 1.12.0-15.el8_8
tigervnc-license RHEL 8 1.12.0-15.el8_8
tigervnc-selinux RHEL 8 1.12.0-15.el8_8
tigervnc-server-module RHEL 8 1.12.0-15.el8_8
tigervnc-server-minimal RHEL 8 1.12.0-15.el8_8
xorg-x11-server RHEL 8 1.20.11-15.el8

red hat advisories RHSA-2025:12751 RHSA-2023:2830 RHSA-2023:2806 RHSA-2023:2805 RHSA-2023:2257 RHSA-2023:2248

xwayland SLE Workstation Extension 15 SP4, openSUSE Leap 15.4 21.1.4-150400.3.6.1
xorg-x11-server SLES 12 SP3-BCL, SLES 12 SP2-BCL 7.6_1.18.3-76.57.1
xorg-x11-server SLES for SAP 12 SP4, SLES 12 SP4-LTSS, OpenStack Cloud Crowbar 9 +1 more 1.19.6-4.39.1
xorg-x11-server SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 1.19.6-10.40.1
xorg-x11-server SLES for SAP 15, SLES 15-LTSS, SLE High Performance Computing 15-LTSS +1 more 1.19.6-150000.8.47.1
xorg-x11-server SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLES 15 SP1-BCL +3 more 1.20.3-150100.14.5.33.1
xorg-x11-server SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +12 more 1.20.3-150200.22.5.63.1
xorg-x11-server SLE Module for Development Tools 15 SP4, SLE Module for Basesystem 15 SP4, openSUSE Leap 15.4 1.20.3-150400.38.13.1

suse advisories SUSE-SU-2022:4487-1 SUSE-SU-2022:4485-1 SUSE-SU-2022:4484-1 SUSE-SU-2022:4483-1 SUSE-SU-2022:4482-1 SUSE-SU-2022:4481-1

xorg-x11-server openSUSE Tumbleweed 21.1.4-6.1
xwayland openSUSE Tumbleweed 22.1.5-2.1

opensuse advisories openSUSE-SU-2024:12569-1 openSUSE-SU-2024:12570-1

xorg-x11-server-Xwayland AlmaLinux 8 21.1.3-10.el8
xorg-x11-server-Xdmx AlmaLinux 8 1.20.11-15.el8
xorg-x11-server-Xorg AlmaLinux 8 1.20.11-15.el8
xorg-x11-server-Xvfb AlmaLinux 8 1.20.11-15.el8
xorg-x11-server-Xnest AlmaLinux 8 1.20.11-15.el8
xorg-x11-server-common AlmaLinux 8 1.20.11-15.el8
xorg-x11-server-source AlmaLinux 8 1.20.11-15.el8
xorg-x11-server-Xephyr AlmaLinux 8 1.20.11-15.el8

almalinux advisories ALSA-2023:2805 ALSA-2023:2806 ALSA-2023:2830 ALSA-2023:2248 ALSA-2023:2249 ALSA-2023:2257

xwayland Alpine 3.24, Alpine 3.23, Alpine 3.22 +5 more 22.1.6-r0
xorg-server Alpine 3.24, Alpine 3.23, Alpine 3.22 +5 more 21.1.5-r0

alpine advisories ALPINE-CVE-2022-46341

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Is CVE-2022-46341 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-46341 updated 2026-11-07 cvss 8.8

xorg-x11-server: XIPassiveUngrab out-of-bounds access

Red Hat Enterprise Linux 6 xorg-x11-server, xorg-x11-server-Xdmx, xorg-x11-server-Xorg, xorg-x11-server-Xvfb, xorg-x11-server-Xnest, xorg-x11-server-common, +2 more
affected: no fix planned “Out of support scope”
Red Hat Enterprise Linux AppStream (v. 8) tigervnc 1.12.0-15.el8_8, tigervnc-icons 1.12.0-15.el8_8, xorg-x11-server 1.20.11-15.el8, tigervnc-server 1.12.0-15.el8_8, tigervnc-license 1.12.0-15.el8_8, tigervnc-selinux 1.12.0-15.el8_8, +9 more
fixed: vendor fix RHSA-2023:2830
Red Hat Enterprise Linux AppStream (v. 9) tigervnc 1.12.0-13.el9_2, tigervnc-icons 1.12.0-13.el9_2, xorg-x11-server 1.20.11-17.el9, tigervnc-server 1.12.0-13.el9_2, tigervnc-license 1.12.0-13.el9_2, tigervnc-selinux 1.12.0-13.el9_2, +9 more
fixed: vendor fix RHSA-2023:2257
Red Hat Enterprise Linux Client (v. 7) tigervnc 1.8.0-23.el7_9, tigervnc-icons 1.8.0-23.el7_9, tigervnc-server 1.8.0-23.el7_9, tigervnc-license 1.8.0-23.el7_9, xorg-x11-server 1.20.4-21.el7_9, xorg-x11-server-Xorg 1.20.4-21.el7_9, +3 more Red Hat Enterprise Linux Client Optional (v. 7) xorg-x11-server-Xdmx 1.20.4-21.el7_9, xorg-x11-server-Xvfb 1.20.4-21.el7_9, tigervnc-server-applet 1.8.0-23.el7_9, tigervnc-server-module 1.8.0-23.el7_9, xorg-x11-server-Xnest 1.20.4-21.el7_9, xorg-x11-server-source 1.20.4-21.el7_9, +1 more Red Hat Enterprise Linux ComputeNode Optional (v. 7) tigervnc 1.8.0-23.el7_9, tigervnc-icons 1.8.0-23.el7_9, tigervnc-server 1.8.0-23.el7_9, xorg-x11-server 1.20.4-21.el7_9, xorg-x11-server-Xdmx 1.20.4-21.el7_9, xorg-x11-server-Xorg 1.20.4-21.el7_9, +8 more
fixed: vendor fix RHSA-2023:0045
Red Hat Enterprise Linux CRB (v. 8) xorg-x11-server-source 1.20.11-15.el8
fixed: vendor fix RHSA-2023:2806
Red Hat Enterprise Linux CRB (v. 9) xorg-x11-server-source 1.20.11-17.el9
fixed: vendor fix RHSA-2023:2248
Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION) tigervnc 1.1.0-25.el6_10.13, tigervnc-server 1.1.0-25.el6_10.13
fixed: vendor fix RHSA-2025:12751
Red Hat Enterprise Linux Server (v. 7) tigervnc 1.8.0-23.el7_9, tigervnc-icons 1.8.0-23.el7_9, tigervnc-server 1.8.0-23.el7_9, tigervnc-license 1.8.0-23.el7_9, xorg-x11-server 1.20.4-21.el7_9, xorg-x11-server-Xorg 1.20.4-21.el7_9, +3 more
fixed: vendor fix RHSA-2023:0045

show 2 more

Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION) tigervnc-server-applet 1.1.0-25.el6_10.13, tigervnc-server-module 1.1.0-25.el6_10.13
fixed: vendor fix RHSA-2025:12751
Red Hat Enterprise Linux Server Optional (v. 7) xorg-x11-server-Xdmx 1.20.4-21.el7_9, xorg-x11-server-Xvfb 1.20.4-21.el7_9, tigervnc-server-applet 1.8.0-23.el7_9, tigervnc-server-module 1.8.0-23.el7_9, xorg-x11-server-Xnest 1.20.4-21.el7_9, xorg-x11-server-source 1.20.4-21.el7_9, +1 more Red Hat Enterprise Linux Workstation (v. 7) tigervnc 1.8.0-23.el7_9, tigervnc-icons 1.8.0-23.el7_9, tigervnc-server 1.8.0-23.el7_9, tigervnc-license 1.8.0-23.el7_9, xorg-x11-server 1.20.4-21.el7_9, xorg-x11-server-Xorg 1.20.4-21.el7_9, +3 more Red Hat Enterprise Linux Workstation Optional (v. 7) xorg-x11-server-Xdmx 1.20.4-21.el7_9, xorg-x11-server-Xvfb 1.20.4-21.el7_9, tigervnc-server-applet 1.8.0-23.el7_9, tigervnc-server-module 1.8.0-23.el7_9, xorg-x11-server-Xnest 1.20.4-21.el7_9, xorg-x11-server-source 1.20.4-21.el7_9, +1 more
fixed: vendor fix RHSA-2023:0045

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: last yr. (2025-04-22)

Exploit prediction

2.72% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

n/a xorg-x11-server

Classification

Weakness

CWE-787 Out-of-bounds Write

References

lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/DXDF2O5PPLE3SVAJJYUOSAD5QZ4TWQ2G/
vendor-advisory, mailing-list, third-party-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/5NELB7YDWRABYYBG4UPTHRBDTKJRV5M2/
vendor-advisory, mailing-list, third-party-advisory
debian.org /security/2022/dsa-5304
vendor-advisory, third-party-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/Z67QC4C3I2FI2WRFIUPEHKC36J362MLA/
vendor-advisory, mailing-list, third-party-advisory
bugzilla.redhat.com /show_bug.cgi?id=2151756
issue-tracking, third-party-advisory
access.redhat.com /security/cve/CVE-2022-46341
third-party-advisory
security.gentoo.org /glsa/202305-30

Sources

CVE List CVE-2022-46341
NVD CVE-2022-46341

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

json all entries feed