In glamor's CopyArea CPU-to-FBO path, the temporary buffer (tmp_bits) is sized based on the destination height but is indexed using source coordinates. When the source region is taller than the destination, writes overflow the allocated buffer.
An authenticated X client can trigger this by performing a CopyArea operation between drawables with mismatched depth (depth-24 to depth-32 or vice versa) where the source is taller than the destination, on a system using glamor/GPU acceleration.

The heap buffer overflow can lead to arbitrary code execution or denial of service.
This issue does not affect xorg-server-21.1.x
Fixed in: xwayland-24.1.14
Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/ad26c26bf795