CVE-2021-31535: n/a vulnerability

CVE-2021-31535: LookupCol.c in X.Org X through X11R7.7 and libX11 before 1.7.1 might allow remote attackers to execute arbi...

LookupCol.c in X.Org X through X11R7.7 and libX11 before 1.7.1 might allow remote attackers to execute arbitrary code. The libX11 XLookupColor request (intended for server-side color lookup) contains a flaw allowing a client to send color-name requests with a name longer than the maximum size allowed by the protocol (and also longer than the maximum packet size for normal-sized packets). The user-controlled data exceeding the maximum size is then interpreted by the server as additional X protocol requests and executed, e.g., to disable X server authorization completely. For example, if the victim encounters malicious terminal control sequences for color codes, then the attacker may be able to take full control of the running graphical session.

UnknownCVSS not scoredNot KEV-listedUpdatedAug 3, 2024, 23:03 UTC (UTC+00:00)

Security readout for executives and security teams

CVE-2021-31535 is a libX11/X.Org flaw where oversized color lookup data can be misread by the X server as extra X11 commands. In the right desktop session, a malicious color/control sequence could let an attacker take over the graphical session. Treat exposed X11 desktop and terminal workflows as high priority. Systems running libX11 before 1.7.1 or X.Org X through X11R7.7 are the relevant exposure. Risk is highest on Unix-like graphical desktops, X11 terminal workflows, and packaged environments that include vulnerable libX11 libraries. Prioritize patching where X11 graphical sessions handle untrusted text or terminal output. This is not KEV-listed in the provided data, but the described impact is serious enough to justify accelerated remediation on desktop and workstation fleets. Mitigation focus: Update libX11 to 1.7.1 or the fixed package from your OS vendor.; Apply relevant Debian, Gentoo, Fedora, or appliance vendor security updates.; Check vendor guidance for embedded, appliance, and container images bundling libX11..

Prepared: Jun 3, 2026, 02:27 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup

cve · low confidence lookup

CVE-2021-31535 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup

Vulnerability profileCVE Program record

Severity: Unknown
CVSS: Not scored
Known Exploited: No
Published: May 27, 2021, 12:26 UTC (UTC+00:00)

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors

0Timeline events

0ADP providers

17Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

CVE List V5 sourceCVE List V5
https://unparalleled.eu/publications/2021/advisory-unpar-2021-1.txtCVE reference · x_refsource_MISC
https://lists.freedesktop.org/archives/xorg/CVE reference · x_refsource_MISC
[debian-lts-announce] 20210524 [SECURITY] [DLA 2666-1] libx11 security updateCVE reference · mailing-list, x_refsource_MLIST
DSA-4920CVE reference · vendor-advisory, x_refsource_DEBIAN
GLSA-202105-16CVE reference · vendor-advisory, x_refsource_GENTOO
https://www.openwall.com/lists/oss-security/2021/05/18/3CVE reference · x_refsource_MISC
https://www.openwall.com/lists/oss-security/2021/05/18/2CVE reference · x_refsource_MISC
https://unparalleled.eu/blog/2021/20210518-using-xterm-to-navigate-the-huge-color-space/CVE reference · x_refsource_MISC
https://lists.x.org/archives/xorg-announce/2021-May/003088.htmlCVE reference · x_refsource_MISC
https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/8d2e02ae650f00c4a53deb625211a0527126c605CVE reference · x_refsource_MISC
https://security.netapp.com/advisory/ntap-20210813-0001/CVE reference · x_refsource_CONFIRM
FEDORA-2021-62bb9998b2CVE reference · vendor-advisory, x_refsource_FEDORA
[kafka-dev] 20210831 Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker imageCVE reference · mailing-list, x_refsource_MLIST
[kafka-users] 20210831 Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker imageCVE reference · mailing-list, x_refsource_MLIST
[kafka-users] 20210901 Re: [EXTERNAL] Re: Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker imageCVE reference · mailing-list, x_refsource_MLIST
[kafka-dev] 20210901 Re: [EXTERNAL] Re: Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker imageCVE reference · mailing-list, x_refsource_MLIST

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus

n/an/an/aListed

Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.