[XInput2 PassiveUngrabDevice Modifier Out-of-Bounds Write]

[RandR ChangeProviderProperty Heap Buffer Overflow]

A flaw was found in xorg-x11-server. The X server incorrectly calculates buffer sizes and memory offsets when prepending or appending data to RandR (Resize and Rotate extension) provider properties. A local attacker can exploit this vulnerability by sending specially crafted property update requests, causing memory corruption. This flaw could allow an attacker to escalate privileges or cause a denial of service (DoS) by crashing the X server.

[RandR ChangeProviderProperty Heap Buffer Overflow]