CVE-2015-9262

26

FAUCET Score

CVE-2015-9262 is a critical one-byte heap overflow vulnerability in the libXcursor library (before version 1.1.15), specifically within the XcursorThemeInherits function in library.c, affecting products from Canonical, Debian, Red Hat, and X. This vulnerability carries a CVSS v3 score of 9.8 (Critical), indicating it can be exploited remotely with low attack complexity and no user interaction, potentially leading to denial of service or arbitrary code execution. Despite its severity, there is no evidence of active exploitation, no publicly available exploit code (Metasploit, Nuclei, ExploitDB), and minimal community discussion or media coverage, suggesting it is not currently a high-profile threat.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		8.0CPE matchmatch criteria	cpe:2.3:o:debian:debian_linux:8.0:::::::*
		14.04CPE matchmatch criteria	cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts:::
		16.04CPE matchmatch criteria	cpe:2.3:o:canonical:ubuntu_linux:16.04::::lts:::
		< 1.1.15CPE matchmatch criteria	cpe:2.3:a:x:libxcursor::::::::
		3.3CPE matchmatch criteria	cpe:2.3:a:redhat:ansible_tower:3.3:::::::*

CVSS Data

CVSS version used by this source: 3.0

9.8CRITICAL

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Exploitability Score

3.9

Impact Score

5.9

CvssVersion

3.0

Exploit Intelligence

EPSS Score

5.91%

Probability of exploitation in next 30 days

EPSS Percentile

92.4%

Percentile rank of EPSS score among Peer Group

As of 2026-07-25

Model: v2026.06.15

This CVE's current EPSS score of 0.0591 is in the 87th percentile among its peer group of 36,833 CVEs.

Social Chatter

No social media mentions found for this CVE.

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (42)

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: freeglut-0:3.0.0-8.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: libdrm-0:2.4.91-3.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: libepoxy-0:1.5.2-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: libglvnd-1:1.0.1-0.8.git5baa1e5.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: libinput-0:1.10.7-2.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: libwacom-0:0.30-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: libX11-0:1.6.5-2.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: libxcb-0:1.13-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: libXcursor-0:1.1.15-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: libXfont-0:1.5.4-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: libXfont2-0:2.0.3-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: libXres-0:1.2.0-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: mesa-0:18.0.5-3.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: mesa-demos-0:8.3.0-10.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: tigervnc-0:1.8.0-13.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: vulkan-0:1.1.73.0-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: xcb-proto-0:1.13-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: xkeyboard-config-0:2.24-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: xorg-x11-drv-ati-0:18.0.1-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: xorg-x11-drv-dummy-0:0.3.7-1.el7.1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: xorg-x11-drv-evdev-0:2.10.6-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: xorg-x11-drv-fbdev-0:0.5.0-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: xorg-x11-drv-intel-0:2.99.917-28.20180530.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: xorg-x11-drv-libinput-0:0.27.1-2.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: xorg-x11-drv-mouse-0:1.9.2-2.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: xorg-x11-drv-nouveau-1:1.0.15-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: xorg-x11-drv-openchrome-0:0.5.0-3.el7.1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: xorg-x11-drv-qxl-0:0.1.5-4.el7.1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: xorg-x11-drv-synaptics-0:1.9.0-2.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: xorg-x11-drv-v4l-0:0.2.0-49.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: xorg-x11-drv-vesa-0:2.4.0-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: xorg-x11-drv-vmmouse-0:13.1.0-1.el7.1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: xorg-x11-drv-vmware-0:13.2.1-1.el7.1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: xorg-x11-drv-void-0:1.4.1-2.el7.1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: xorg-x11-drv-wacom-0:0.36.1-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: xorg-x11-font-utils-1:7.5-21.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: xorg-x11-proto-devel-0:2018.4-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: xorg-x11-server-0:1.20.1-3.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: xorg-x11-utils-0:7.5-23.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: xorg-x11-xkb-utils-0:7.7-14.el7

redhatend of lifevia redhat_api

Product: Red Hat Enterprise Linux 5Fixed in: libXcursor

redhatend of lifevia redhat_api

Product: Red Hat Enterprise Linux 6Fixed in: libXcursor

Vendor Advisories (1)

redhatCVE-2015-9262Low

libxcursor: 1-byte heap-based overflow in _XcursorThemeInherits function in library.c

References

access.redhat.com / errata/RHSA-2018:3059

Third Party Advisory

access.redhat.com / errata/RHSA-2018:3505

Third Party Advisory

bugs.freedesktop.org / show_bug.cgi

PatchThird Party Advisory

cgit.freedesktop.org / xorg/lib/libXcursor/commit

PatchThird Party Advisory

lists.debian.org / debian-lts-announce/2018/08/msg00016.html

Mailing ListThird Party Advisory

usn.ubuntu.com / 3729-1

Third Party Advisory