Log in Start free

Vulnerability · Published Mar 16, 2025 · Assigned by mitre

CVE-2022-49737

High 7.7

In plain English

A high-severity security flaw in X server from X.org. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.7High
Exploit odds (30 days)0.3%top 72.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

In X.Org X server 20.11 through 21.1.16, when a client application uses easystroke for mouse gestures, the main thread modifies various data structures used by the input thread without acquiring a lock, aka a race condition. In particular, AttachDevice in dix/devices.c does not acquire an input lock.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12xorg-server2:21.1.7-3+deb12u13DEBIAN-CVE-2022-49737
Debian:13xorg-server2:21.1.16-1.1DEBIAN-CVE-2022-49737
Debian:14xorg-server2:21.1.16-1.1DEBIAN-CVE-2022-49737
Ubuntu:22.04:LTSxorg-serverno fix listedUBUNTU-CVE-2022-49737
Ubuntu:24.04:LTSxorg-serverno fix listedUBUNTU-CVE-2022-49737
Ubuntu:25.10xorg-server2:21.1.18-1ubuntu1UBUNTU-CVE-2022-49737
Ubuntu:26.04:LTSxorg-server2:21.1.18-1ubuntu1UBUNTU-CVE-2022-49737
Ubuntu:22.04:LTSxwaylandno fix listedUBUNTU-CVE-2022-49737
Ubuntu:24.04:LTSxwaylandno fix listedUBUNTU-CVE-2022-49737
Ubuntu:25.10xwaylandno fix listedUBUNTU-CVE-2022-49737
Ubuntu:26.04:LTSxwaylandno fix listedUBUNTU-CVE-2022-49737
Ubuntu:26.10xwaylandno fix listedUBUNTU-CVE-2022-49737

Affected products (as reported)

VendorProductVersions
X.org X server 20.11 – through 21.1.16

Weakness: CWE-413 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H

References