CVE-2023-6816 is a critical (CVSS 9.8) heap buffer overflow in the X.Org X server and Xwayland, triggered through DeviceFocusEvent and XIQueryPointer replies when buttons are mapped to large values. Install your distribution's xorg-server and xwayland updates and restart the display server.
What's affected
The record lists X.Org X server and Xwayland, plus Fedora 39, and references several Red Hat errata (RHSA-2024:0320, 0557, 0558 and 0597). Those pages did not load for automated reading, so fixed package versions are not restated here. Check your distribution's advisory for the fixed build.
The issue concerns the X server's handling of button state. It matters most on multi-user systems, remote desktops and shared machines where several people run X clients against one server.
How to check if you're exposed
Check the installed server packages.
Xorg -version 2>&1 | head -n 3
Xwayland -version 2>&1 | head -n 3
rpm -q xorg-x11-server-Xorg xorg-x11-server-Xwayland # RPM systems
dpkg -l | grep -E 'xserver-xorg-core|xwayland' # Debian and Ubuntu
Compare with your vendor's advisory for CVE-2023-6816. Remember that Xwayland is present on many Wayland desktops by default.
What to do now
- Install the vendor updates for the X server and Xwayland packages.
- Log out and restart the display manager, or reboot, so the new server binary is running.
- On shared systems, limit who can connect to the display and avoid exposing X over the network.
- Check VDI and remote desktop images, which often bundle their own X server.
Why it matters
The description says DeviceFocusEvent and the XIQueryPointer reply carry a bit for every logical button currently down. Buttons can be mapped to any value up to 255, but the server allocated space only for the device's actual number of buttons. A larger mapped value then writes past the heap allocation.
Memory safety bugs like this one come from code that trusts a length it never verified. In C and C++ the compiler will not stop a write past the end of a buffer, so the check has to be written by hand and has to be right on every path. X servers are old and large and run with high privilege on many systems, so heap bugs there get a critical score. The record tags CWE-787.
Base libraries reach your estate by many routes: operating system packages, container base images and statically linked builds. Update the source of each route, not only the host you checked first. Rebuild images, restart long-running processes, and verify afterward with a fresh scan.
Weakness class in the record: CWE-787 (Out-of-bounds Write).
Quick check
Do headless servers need this update?
Servers with no X server or Xwayland installed are not affected by the package. Desktop, VDI, and container images that include X components are.
How do I know all my images and hosts are covered?
Scan every image and host for the affected package and version. Images built before the fix keep the old library until they are rebuilt, and running processes keep it until they restart.
Sources
Last reviewed: 19 October 2026.
