csaf_suse - suse-su-2025:0729-1

Vulnerability from csaf_suse

Published

2025-02-26 14:14

Modified

2025-02-26 14:14

Summary

Security update for xwayland

Notes

Title of the patch

Security update for xwayland

Description of the patch

This update for xwayland fixes the following issues: - CVE-2025-26594: Use-after-free of the root cursor (bsc#1237427). - CVE-2025-26595: Buffer overflow in XkbVModMaskText() (bsc#1237429). - CVE-2025-26596: Heap overflow in XkbWriteKeySyms() (bsc#1237430). - CVE-2025-26597: Buffer overflow in XkbChangeTypesOfKey() (bsc#1237431). - CVE-2025-26598: Out-of-bounds write in CreatePointerBarrierClient() (bsc#1237432). - CVE-2025-26599: Use of uninitialized pointer in compRedirectWindow() (bsc#1237433). - CVE-2025-26600: Use-after-free in PlayReleasedEvents() (bsc#1237434). - CVE-2025-26601: Use-after-free in SyncInitTrigger() (bsc#1237435).

Patchnames

SUSE-2025-729,SUSE-SLE-Product-WE-15-SP6-2025-729,openSUSE-SLE-15.6-2025-729

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
   document: {
      aggregate_severity: {
         namespace: "https://www.suse.com/support/security/rating/",
         text: "important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright 2024 SUSE LLC. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Security update for xwayland",
            title: "Title of the patch",
         },
         {
            category: "description",
            text: "This update for xwayland fixes the following issues:\n\n- CVE-2025-26594: Use-after-free of the root cursor (bsc#1237427).\n- CVE-2025-26595: Buffer overflow in XkbVModMaskText() (bsc#1237429).\n- CVE-2025-26596: Heap overflow in XkbWriteKeySyms() (bsc#1237430).\n- CVE-2025-26597: Buffer overflow in XkbChangeTypesOfKey() (bsc#1237431).\n- CVE-2025-26598: Out-of-bounds write in CreatePointerBarrierClient() (bsc#1237432).\n- CVE-2025-26599: Use of uninitialized pointer in compRedirectWindow() (bsc#1237433).\n- CVE-2025-26600: Use-after-free in PlayReleasedEvents() (bsc#1237434).\n- CVE-2025-26601: Use-after-free in SyncInitTrigger() (bsc#1237435).\n",
            title: "Description of the patch",
         },
         {
            category: "details",
            text: "SUSE-2025-729,SUSE-SLE-Product-WE-15-SP6-2025-729,openSUSE-SLE-15.6-2025-729",
            title: "Patchnames",
         },
         {
            category: "legal_disclaimer",
            text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
            title: "Terms of use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://www.suse.com/support/security/contact/",
         name: "SUSE Product Security Team",
         namespace: "https://www.suse.com/",
      },
      references: [
         {
            category: "external",
            summary: "SUSE ratings",
            url: "https://www.suse.com/support/security/rating/",
         },
         {
            category: "self",
            summary: "URL of this CSAF notice",
            url: "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_0729-1.json",
         },
         {
            category: "self",
            summary: "URL for SUSE-SU-2025:0729-1",
            url: "https://www.suse.com/support/update/announcement/2025/suse-su-20250729-1/",
         },
         {
            category: "self",
            summary: "E-Mail link for SUSE-SU-2025:0729-1",
            url: "https://lists.suse.com/pipermail/sle-security-updates/2025-February/020442.html",
         },
         {
            category: "self",
            summary: "SUSE Bug 1237427",
            url: "https://bugzilla.suse.com/1237427",
         },
         {
            category: "self",
            summary: "SUSE Bug 1237429",
            url: "https://bugzilla.suse.com/1237429",
         },
         {
            category: "self",
            summary: "SUSE Bug 1237430",
            url: "https://bugzilla.suse.com/1237430",
         },
         {
            category: "self",
            summary: "SUSE Bug 1237431",
            url: "https://bugzilla.suse.com/1237431",
         },
         {
            category: "self",
            summary: "SUSE Bug 1237432",
            url: "https://bugzilla.suse.com/1237432",
         },
         {
            category: "self",
            summary: "SUSE Bug 1237433",
            url: "https://bugzilla.suse.com/1237433",
         },
         {
            category: "self",
            summary: "SUSE Bug 1237434",
            url: "https://bugzilla.suse.com/1237434",
         },
         {
            category: "self",
            summary: "SUSE Bug 1237435",
            url: "https://bugzilla.suse.com/1237435",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2025-26594 page",
            url: "https://www.suse.com/security/cve/CVE-2025-26594/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2025-26595 page",
            url: "https://www.suse.com/security/cve/CVE-2025-26595/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2025-26596 page",
            url: "https://www.suse.com/security/cve/CVE-2025-26596/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2025-26597 page",
            url: "https://www.suse.com/security/cve/CVE-2025-26597/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2025-26598 page",
            url: "https://www.suse.com/security/cve/CVE-2025-26598/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2025-26599 page",
            url: "https://www.suse.com/security/cve/CVE-2025-26599/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2025-26600 page",
            url: "https://www.suse.com/security/cve/CVE-2025-26600/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2025-26601 page",
            url: "https://www.suse.com/security/cve/CVE-2025-26601/",
         },
      ],
      title: "Security update for xwayland",
      tracking: {
         current_release_date: "2025-02-26T14:14:28Z",
         generator: {
            date: "2025-02-26T14:14:28Z",
            engine: {
               name: "cve-database.git:bin/generate-csaf.pl",
               version: "1",
            },
         },
         id: "SUSE-SU-2025:0729-1",
         initial_release_date: "2025-02-26T14:14:28Z",
         revision_history: [
            {
               date: "2025-02-26T14:14:28Z",
               number: "1",
               summary: "Current version",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "xwayland-24.1.1-150600.5.9.1.aarch64",
                        product: {
                           name: "xwayland-24.1.1-150600.5.9.1.aarch64",
                           product_id: "xwayland-24.1.1-150600.5.9.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "xwayland-devel-24.1.1-150600.5.9.1.aarch64",
                        product: {
                           name: "xwayland-devel-24.1.1-150600.5.9.1.aarch64",
                           product_id: "xwayland-devel-24.1.1-150600.5.9.1.aarch64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "aarch64",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "xwayland-24.1.1-150600.5.9.1.i586",
                        product: {
                           name: "xwayland-24.1.1-150600.5.9.1.i586",
                           product_id: "xwayland-24.1.1-150600.5.9.1.i586",
                        },
                     },
                     {
                        category: "product_version",
                        name: "xwayland-devel-24.1.1-150600.5.9.1.i586",
                        product: {
                           name: "xwayland-devel-24.1.1-150600.5.9.1.i586",
                           product_id: "xwayland-devel-24.1.1-150600.5.9.1.i586",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "i586",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "xwayland-24.1.1-150600.5.9.1.ppc64le",
                        product: {
                           name: "xwayland-24.1.1-150600.5.9.1.ppc64le",
                           product_id: "xwayland-24.1.1-150600.5.9.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "xwayland-devel-24.1.1-150600.5.9.1.ppc64le",
                        product: {
                           name: "xwayland-devel-24.1.1-150600.5.9.1.ppc64le",
                           product_id: "xwayland-devel-24.1.1-150600.5.9.1.ppc64le",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "ppc64le",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "xwayland-24.1.1-150600.5.9.1.s390x",
                        product: {
                           name: "xwayland-24.1.1-150600.5.9.1.s390x",
                           product_id: "xwayland-24.1.1-150600.5.9.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "xwayland-devel-24.1.1-150600.5.9.1.s390x",
                        product: {
                           name: "xwayland-devel-24.1.1-150600.5.9.1.s390x",
                           product_id: "xwayland-devel-24.1.1-150600.5.9.1.s390x",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "s390x",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "xwayland-24.1.1-150600.5.9.1.x86_64",
                        product: {
                           name: "xwayland-24.1.1-150600.5.9.1.x86_64",
                           product_id: "xwayland-24.1.1-150600.5.9.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "xwayland-devel-24.1.1-150600.5.9.1.x86_64",
                        product: {
                           name: "xwayland-devel-24.1.1-150600.5.9.1.x86_64",
                           product_id: "xwayland-devel-24.1.1-150600.5.9.1.x86_64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "x86_64",
               },
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Workstation Extension 15 SP6",
                        product: {
                           name: "SUSE Linux Enterprise Workstation Extension 15 SP6",
                           product_id: "SUSE Linux Enterprise Workstation Extension 15 SP6",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sle-we:15:sp6",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "openSUSE Leap 15.6",
                        product: {
                           name: "openSUSE Leap 15.6",
                           product_id: "openSUSE Leap 15.6",
                           product_identification_helper: {
                              cpe: "cpe:/o:opensuse:leap:15.6",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "SUSE Linux Enterprise",
               },
            ],
            category: "vendor",
            name: "SUSE",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "xwayland-24.1.1-150600.5.9.1.x86_64 as component of SUSE Linux Enterprise Workstation Extension 15 SP6",
               product_id: "SUSE Linux Enterprise Workstation Extension 15 SP6:xwayland-24.1.1-150600.5.9.1.x86_64",
            },
            product_reference: "xwayland-24.1.1-150600.5.9.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Workstation Extension 15 SP6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "xwayland-24.1.1-150600.5.9.1.aarch64 as component of openSUSE Leap 15.6",
               product_id: "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.aarch64",
            },
            product_reference: "xwayland-24.1.1-150600.5.9.1.aarch64",
            relates_to_product_reference: "openSUSE Leap 15.6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "xwayland-24.1.1-150600.5.9.1.ppc64le as component of openSUSE Leap 15.6",
               product_id: "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.ppc64le",
            },
            product_reference: "xwayland-24.1.1-150600.5.9.1.ppc64le",
            relates_to_product_reference: "openSUSE Leap 15.6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "xwayland-24.1.1-150600.5.9.1.s390x as component of openSUSE Leap 15.6",
               product_id: "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.s390x",
            },
            product_reference: "xwayland-24.1.1-150600.5.9.1.s390x",
            relates_to_product_reference: "openSUSE Leap 15.6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "xwayland-24.1.1-150600.5.9.1.x86_64 as component of openSUSE Leap 15.6",
               product_id: "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.x86_64",
            },
            product_reference: "xwayland-24.1.1-150600.5.9.1.x86_64",
            relates_to_product_reference: "openSUSE Leap 15.6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "xwayland-devel-24.1.1-150600.5.9.1.aarch64 as component of openSUSE Leap 15.6",
               product_id: "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.aarch64",
            },
            product_reference: "xwayland-devel-24.1.1-150600.5.9.1.aarch64",
            relates_to_product_reference: "openSUSE Leap 15.6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "xwayland-devel-24.1.1-150600.5.9.1.ppc64le as component of openSUSE Leap 15.6",
               product_id: "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.ppc64le",
            },
            product_reference: "xwayland-devel-24.1.1-150600.5.9.1.ppc64le",
            relates_to_product_reference: "openSUSE Leap 15.6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "xwayland-devel-24.1.1-150600.5.9.1.s390x as component of openSUSE Leap 15.6",
               product_id: "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.s390x",
            },
            product_reference: "xwayland-devel-24.1.1-150600.5.9.1.s390x",
            relates_to_product_reference: "openSUSE Leap 15.6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "xwayland-devel-24.1.1-150600.5.9.1.x86_64 as component of openSUSE Leap 15.6",
               product_id: "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.x86_64",
            },
            product_reference: "xwayland-devel-24.1.1-150600.5.9.1.x86_64",
            relates_to_product_reference: "openSUSE Leap 15.6",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2025-26594",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2025-26594",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a global variable. If a client frees the root cursor, the internal reference points to freed memory and causes a use-after-free.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Workstation Extension 15 SP6:xwayland-24.1.1-150600.5.9.1.x86_64",
               "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.aarch64",
               "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.ppc64le",
               "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.s390x",
               "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.x86_64",
               "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.aarch64",
               "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.ppc64le",
               "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.s390x",
               "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2025-26594",
               url: "https://www.suse.com/security/cve/CVE-2025-26594",
            },
            {
               category: "external",
               summary: "SUSE Bug 1237427 for CVE-2025-26594",
               url: "https://bugzilla.suse.com/1237427",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Workstation Extension 15 SP6:xwayland-24.1.1-150600.5.9.1.x86_64",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.aarch64",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.ppc64le",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.s390x",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.x86_64",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.aarch64",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.ppc64le",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.s390x",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Workstation Extension 15 SP6:xwayland-24.1.1-150600.5.9.1.x86_64",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.aarch64",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.ppc64le",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.s390x",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.x86_64",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.aarch64",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.ppc64le",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.s390x",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-02-26T14:14:28Z",
               details: "important",
            },
         ],
         title: "CVE-2025-26594",
      },
      {
         cve: "CVE-2025-26595",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2025-26595",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A buffer overflow flaw was found in X.Org and Xwayland. The code in XkbVModMaskText() allocates a fixed-sized buffer on the stack and copies the names of the virtual modifiers to that buffer. The code fails to check the bounds of the buffer and would copy the data regardless of the size.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Workstation Extension 15 SP6:xwayland-24.1.1-150600.5.9.1.x86_64",
               "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.aarch64",
               "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.ppc64le",
               "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.s390x",
               "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.x86_64",
               "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.aarch64",
               "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.ppc64le",
               "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.s390x",
               "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2025-26595",
               url: "https://www.suse.com/security/cve/CVE-2025-26595",
            },
            {
               category: "external",
               summary: "SUSE Bug 1237429 for CVE-2025-26595",
               url: "https://bugzilla.suse.com/1237429",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Workstation Extension 15 SP6:xwayland-24.1.1-150600.5.9.1.x86_64",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.aarch64",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.ppc64le",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.s390x",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.x86_64",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.aarch64",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.ppc64le",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.s390x",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Workstation Extension 15 SP6:xwayland-24.1.1-150600.5.9.1.x86_64",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.aarch64",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.ppc64le",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.s390x",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.x86_64",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.aarch64",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.ppc64le",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.s390x",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-02-26T14:14:28Z",
               details: "moderate",
            },
         ],
         title: "CVE-2025-26595",
      },
      {
         cve: "CVE-2025-26596",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2025-26596",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A heap overflow flaw was found in X.Org and Xwayland. The computation of the length in XkbSizeKeySyms() differs from what is written in XkbWriteKeySyms(), which may lead to a heap-based buffer overflow.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Workstation Extension 15 SP6:xwayland-24.1.1-150600.5.9.1.x86_64",
               "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.aarch64",
               "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.ppc64le",
               "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.s390x",
               "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.x86_64",
               "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.aarch64",
               "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.ppc64le",
               "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.s390x",
               "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2025-26596",
               url: "https://www.suse.com/security/cve/CVE-2025-26596",
            },
            {
               category: "external",
               summary: "SUSE Bug 1237430 for CVE-2025-26596",
               url: "https://bugzilla.suse.com/1237430",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Workstation Extension 15 SP6:xwayland-24.1.1-150600.5.9.1.x86_64",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.aarch64",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.ppc64le",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.s390x",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.x86_64",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.aarch64",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.ppc64le",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.s390x",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Workstation Extension 15 SP6:xwayland-24.1.1-150600.5.9.1.x86_64",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.aarch64",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.ppc64le",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.s390x",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.x86_64",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.aarch64",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.ppc64le",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.s390x",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-02-26T14:14:28Z",
               details: "moderate",
            },
         ],
         title: "CVE-2025-26596",
      },
      {
         cve: "CVE-2025-26597",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2025-26597",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A buffer overflow flaw was found in X.Org and Xwayland. If XkbChangeTypesOfKey() is called with a 0 group, it will resize the key symbols table to 0 but leave the key actions unchanged. If the same function is later called with a non-zero value of groups, this will cause a buffer overflow because the key actions are of the wrong size.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Workstation Extension 15 SP6:xwayland-24.1.1-150600.5.9.1.x86_64",
               "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.aarch64",
               "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.ppc64le",
               "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.s390x",
               "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.x86_64",
               "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.aarch64",
               "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.ppc64le",
               "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.s390x",
               "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2025-26597",
               url: "https://www.suse.com/security/cve/CVE-2025-26597",
            },
            {
               category: "external",
               summary: "SUSE Bug 1237431 for CVE-2025-26597",
               url: "https://bugzilla.suse.com/1237431",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Workstation Extension 15 SP6:xwayland-24.1.1-150600.5.9.1.x86_64",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.aarch64",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.ppc64le",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.s390x",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.x86_64",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.aarch64",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.ppc64le",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.s390x",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Workstation Extension 15 SP6:xwayland-24.1.1-150600.5.9.1.x86_64",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.aarch64",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.ppc64le",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.s390x",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.x86_64",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.aarch64",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.ppc64le",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.s390x",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-02-26T14:14:28Z",
               details: "moderate",
            },
         ],
         title: "CVE-2025-26597",
      },
      {
         cve: "CVE-2025-26598",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2025-26598",
            },
         ],
         notes: [
            {
               category: "general",
               text: "An out-of-bounds write flaw was found in X.Org and Xwayland. The function GetBarrierDevice() searches for the pointer device based on its device ID and returns the matching value, or supposedly NULL, if no match was found. However, the code will return the last element of the list if no matching device ID is found, which can lead to out-of-bounds memory access.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Workstation Extension 15 SP6:xwayland-24.1.1-150600.5.9.1.x86_64",
               "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.aarch64",
               "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.ppc64le",
               "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.s390x",
               "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.x86_64",
               "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.aarch64",
               "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.ppc64le",
               "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.s390x",
               "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2025-26598",
               url: "https://www.suse.com/security/cve/CVE-2025-26598",
            },
            {
               category: "external",
               summary: "SUSE Bug 1237432 for CVE-2025-26598",
               url: "https://bugzilla.suse.com/1237432",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Workstation Extension 15 SP6:xwayland-24.1.1-150600.5.9.1.x86_64",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.aarch64",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.ppc64le",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.s390x",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.x86_64",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.aarch64",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.ppc64le",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.s390x",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Workstation Extension 15 SP6:xwayland-24.1.1-150600.5.9.1.x86_64",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.aarch64",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.ppc64le",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.s390x",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.x86_64",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.aarch64",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.ppc64le",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.s390x",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-02-26T14:14:28Z",
               details: "moderate",
            },
         ],
         title: "CVE-2025-26598",
      },
      {
         cve: "CVE-2025-26599",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2025-26599",
            },
         ],
         notes: [
            {
               category: "general",
               text: "An access to an uninitialized pointer flaw was found in X.Org and Xwayland. The function compCheckRedirect() may fail if it cannot allocate the backing pixmap. In that case, compRedirectWindow() will return a BadAlloc error without validating the window tree marked just before, which leaves the validated data partly initialized and the use of an uninitialized pointer later.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Workstation Extension 15 SP6:xwayland-24.1.1-150600.5.9.1.x86_64",
               "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.aarch64",
               "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.ppc64le",
               "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.s390x",
               "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.x86_64",
               "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.aarch64",
               "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.ppc64le",
               "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.s390x",
               "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2025-26599",
               url: "https://www.suse.com/security/cve/CVE-2025-26599",
            },
            {
               category: "external",
               summary: "SUSE Bug 1237433 for CVE-2025-26599",
               url: "https://bugzilla.suse.com/1237433",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Workstation Extension 15 SP6:xwayland-24.1.1-150600.5.9.1.x86_64",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.aarch64",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.ppc64le",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.s390x",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.x86_64",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.aarch64",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.ppc64le",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.s390x",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Workstation Extension 15 SP6:xwayland-24.1.1-150600.5.9.1.x86_64",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.aarch64",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.ppc64le",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.s390x",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.x86_64",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.aarch64",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.ppc64le",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.s390x",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-02-26T14:14:28Z",
               details: "moderate",
            },
         ],
         title: "CVE-2025-26599",
      },
      {
         cve: "CVE-2025-26600",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2025-26600",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A use-after-free flaw was found in X.Org and Xwayland. When a device is removed while still frozen, the events queued for that device remain while the device is freed. Replaying the events will cause a use-after-free.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Workstation Extension 15 SP6:xwayland-24.1.1-150600.5.9.1.x86_64",
               "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.aarch64",
               "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.ppc64le",
               "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.s390x",
               "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.x86_64",
               "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.aarch64",
               "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.ppc64le",
               "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.s390x",
               "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2025-26600",
               url: "https://www.suse.com/security/cve/CVE-2025-26600",
            },
            {
               category: "external",
               summary: "SUSE Bug 1237434 for CVE-2025-26600",
               url: "https://bugzilla.suse.com/1237434",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Workstation Extension 15 SP6:xwayland-24.1.1-150600.5.9.1.x86_64",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.aarch64",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.ppc64le",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.s390x",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.x86_64",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.aarch64",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.ppc64le",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.s390x",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Workstation Extension 15 SP6:xwayland-24.1.1-150600.5.9.1.x86_64",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.aarch64",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.ppc64le",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.s390x",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.x86_64",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.aarch64",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.ppc64le",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.s390x",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-02-26T14:14:28Z",
               details: "important",
            },
         ],
         title: "CVE-2025-26600",
      },
      {
         cve: "CVE-2025-26601",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2025-26601",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A use-after-free flaw was found in X.Org and Xwayland. When changing an alarm, the values of the change mask are evaluated one after the other, changing the trigger values as requested, and eventually, SyncInitTrigger() is called. If one of the changes triggers an error, the function will return early, not adding the new sync object, possibly causing a use-after-free when the alarm eventually triggers.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Workstation Extension 15 SP6:xwayland-24.1.1-150600.5.9.1.x86_64",
               "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.aarch64",
               "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.ppc64le",
               "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.s390x",
               "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.x86_64",
               "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.aarch64",
               "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.ppc64le",
               "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.s390x",
               "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2025-26601",
               url: "https://www.suse.com/security/cve/CVE-2025-26601",
            },
            {
               category: "external",
               summary: "SUSE Bug 1237435 for CVE-2025-26601",
               url: "https://bugzilla.suse.com/1237435",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Workstation Extension 15 SP6:xwayland-24.1.1-150600.5.9.1.x86_64",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.aarch64",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.ppc64le",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.s390x",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.x86_64",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.aarch64",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.ppc64le",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.s390x",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Workstation Extension 15 SP6:xwayland-24.1.1-150600.5.9.1.x86_64",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.aarch64",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.ppc64le",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.s390x",
                  "openSUSE Leap 15.6:xwayland-24.1.1-150600.5.9.1.x86_64",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.aarch64",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.ppc64le",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.s390x",
                  "openSUSE Leap 15.6:xwayland-devel-24.1.1-150600.5.9.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-02-26T14:14:28Z",
               details: "important",
            },
         ],
         title: "CVE-2025-26601",
      },
   ],
}

cve-2025-26594

Vulnerability from cvelistv5

Published

2025-02-25 15:53

Modified

2025-03-27 04:19

Severity ?

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a global variable. If a client frees the root cursor, the internal reference points to freed memory and causes a use-after-free.

References

▼	URL	Tags
	https://access.redhat.com/errata/RHSA-2025:2500	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2502	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2861	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2862	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2865	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2866	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2873	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2874	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2875	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2879	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2880	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/security/cve/CVE-2025-26594	vdb-entry, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2345248	issue-tracking, x_refsource_REDHAT

Impacted products

Vendor

Product

Version

▼

Version: 0 ≤
Version: 22.0.0 ≤

Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:1.8.0-36.el7_9 < * cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:1.20.4-30.el7_9 < * cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:1.13.1-15.el8_10 < * cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	Unaffected: 0:1.9.0-15.el8_2.13 < * cpe:/a:redhat:rhel_aus:8.2::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:1.11.0-8.el8_4.12 < * cpe:/a:redhat:rhel_e4s:8.4::appstream cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_tus:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Telecommunications Update Service	Unaffected: 0:1.11.0-8.el8_4.12 < * cpe:/a:redhat:rhel_e4s:8.4::appstream cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_tus:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions	Unaffected: 0:1.11.0-8.el8_4.12 < * cpe:/a:redhat:rhel_e4s:8.4::appstream cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_tus:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:1.12.0-6.el8_6.13 < * cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/a:redhat:rhel_e4s:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	Unaffected: 0:1.12.0-6.el8_6.13 < * cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/a:redhat:rhel_e4s:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	Unaffected: 0:1.12.0-6.el8_6.13 < * cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/a:redhat:rhel_e4s:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	Unaffected: 0:1.12.0-15.el8_8.12 < * cpe:/a:redhat:rhel_eus:8.8::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:1.14.1-1.el9_5.1 < * cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	Unaffected: 0:1.11.0-22.el9_0.13 < * cpe:/a:redhat:rhel_e4s:9.0::appstream
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	Unaffected: 0:1.12.0-14.el9_2.10 < * cpe:/a:redhat:rhel_eus:9.2::appstream
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 0:1.13.1-8.el9_4.5 < * cpe:/a:redhat:rhel_eus:9.4::appstream
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2025-26594",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-25T20:13:53.357050Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-25T20:14:16.754Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               collectionURL: "https://gitlab.freedesktop.org/xorg/xserver/",
               defaultStatus: "unaffected",
               packageName: "xserver",
               versions: [
                  {
                     lessThan: "21.1.16",
                     status: "affected",
                     version: "0",
                     versionType: "semver",
                  },
                  {
                     lessThan: "24.1.6",
                     status: "affected",
                     version: "22.0.0",
                     versionType: "semver",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:rhel_els:7",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.8.0-36.el7_9",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:rhel_els:7",
               ],
               defaultStatus: "affected",
               packageName: "xorg-x11-server",
               product: "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.20.4-30.el7_9",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:enterprise_linux:8::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.13.1-15.el8_10",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_aus:8.2::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.2 Advanced Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.9.0-15.el8_2.13",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_e4s:8.4::appstream",
                  "cpe:/a:redhat:rhel_aus:8.4::appstream",
                  "cpe:/a:redhat:rhel_tus:8.4::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.11.0-8.el8_4.12",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_e4s:8.4::appstream",
                  "cpe:/a:redhat:rhel_aus:8.4::appstream",
                  "cpe:/a:redhat:rhel_tus:8.4::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.4 Telecommunications Update Service",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.11.0-8.el8_4.12",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_e4s:8.4::appstream",
                  "cpe:/a:redhat:rhel_aus:8.4::appstream",
                  "cpe:/a:redhat:rhel_tus:8.4::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.11.0-8.el8_4.12",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_aus:8.6::appstream",
                  "cpe:/a:redhat:rhel_tus:8.6::appstream",
                  "cpe:/a:redhat:rhel_e4s:8.6::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.12.0-6.el8_6.13",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_aus:8.6::appstream",
                  "cpe:/a:redhat:rhel_tus:8.6::appstream",
                  "cpe:/a:redhat:rhel_e4s:8.6::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.12.0-6.el8_6.13",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_aus:8.6::appstream",
                  "cpe:/a:redhat:rhel_tus:8.6::appstream",
                  "cpe:/a:redhat:rhel_e4s:8.6::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.12.0-6.el8_6.13",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_eus:8.8::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.8 Extended Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.12.0-15.el8_8.12",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:enterprise_linux:9::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 9",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.14.1-1.el9_5.1",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_e4s:9.0::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.11.0-22.el9_0.13",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_eus:9.2::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 9.2 Extended Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.12.0-14.el9_2.10",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_eus:9.4::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 9.4 Extended Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.13.1-8.el9_4.5",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:6",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:6",
               ],
               defaultStatus: "unknown",
               packageName: "xorg-x11-server",
               product: "Red Hat Enterprise Linux 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:8",
               ],
               defaultStatus: "unaffected",
               packageName: "xorg-x11-server",
               product: "Red Hat Enterprise Linux 8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:8",
               ],
               defaultStatus: "unaffected",
               packageName: "xorg-x11-server-Xwayland",
               product: "Red Hat Enterprise Linux 8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:9",
               ],
               defaultStatus: "affected",
               packageName: "xorg-x11-server",
               product: "Red Hat Enterprise Linux 9",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:9",
               ],
               defaultStatus: "affected",
               packageName: "xorg-x11-server-Xwayland",
               product: "Red Hat Enterprise Linux 9",
               vendor: "Red Hat",
            },
         ],
         datePublic: "2025-02-25T00:00:00.000Z",
         descriptions: [
            {
               lang: "en",
               value: "A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a global variable. If a client frees the root cursor, the internal reference points to freed memory and causes a use-after-free.",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     namespace: "https://access.redhat.com/security/updates/classification/",
                     value: "Important",
                  },
                  type: "Red Hat severity rating",
               },
            },
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-416",
                     description: "Use After Free",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-03-27T04:19:40.033Z",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "RHSA-2025:2500",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2500",
            },
            {
               name: "RHSA-2025:2502",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2502",
            },
            {
               name: "RHSA-2025:2861",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2861",
            },
            {
               name: "RHSA-2025:2862",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2862",
            },
            {
               name: "RHSA-2025:2865",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2865",
            },
            {
               name: "RHSA-2025:2866",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2866",
            },
            {
               name: "RHSA-2025:2873",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2873",
            },
            {
               name: "RHSA-2025:2874",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2874",
            },
            {
               name: "RHSA-2025:2875",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2875",
            },
            {
               name: "RHSA-2025:2879",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2879",
            },
            {
               name: "RHSA-2025:2880",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2880",
            },
            {
               tags: [
                  "vdb-entry",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/security/cve/CVE-2025-26594",
            },
            {
               name: "RHBZ#2345248",
               tags: [
                  "issue-tracking",
                  "x_refsource_REDHAT",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2345248",
            },
         ],
         timeline: [
            {
               lang: "en",
               time: "2025-02-12T14:14:54.698000+00:00",
               value: "Reported to Red Hat.",
            },
            {
               lang: "en",
               time: "2025-02-25T00:00:00+00:00",
               value: "Made public.",
            },
         ],
         title: "X.org: xwayland: use-after-free of the root cursor",
         workarounds: [
            {
               lang: "en",
               value: "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
            },
         ],
         x_redhatCweChain: "CWE-416: Use After Free",
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2025-26594",
      datePublished: "2025-02-25T15:53:51.324Z",
      dateReserved: "2025-02-12T14:12:22.795Z",
      dateUpdated: "2025-03-27T04:19:40.033Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2025-26595

Vulnerability from cvelistv5

Published

2025-02-25 15:54

Modified

2025-03-27 04:19

Severity ?

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

A buffer overflow flaw was found in X.Org and Xwayland. The code in XkbVModMaskText() allocates a fixed-sized buffer on the stack and copies the names of the virtual modifiers to that buffer. The code fails to check the bounds of the buffer and would copy the data regardless of the size.

References

▼	URL	Tags
	https://access.redhat.com/errata/RHSA-2025:2500	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2502	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2861	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2862	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2865	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2866	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2873	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2874	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2875	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2879	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2880	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/security/cve/CVE-2025-26595	vdb-entry, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2345257	issue-tracking, x_refsource_REDHAT

Impacted products

Vendor

Product

Version

▼

Version: 0 ≤
Version: 22.0.0 ≤

Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:1.8.0-36.el7_9 < * cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:1.20.4-30.el7_9 < * cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:1.13.1-15.el8_10 < * cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	Unaffected: 0:1.9.0-15.el8_2.13 < * cpe:/a:redhat:rhel_aus:8.2::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:1.11.0-8.el8_4.12 < * cpe:/a:redhat:rhel_tus:8.4::appstream cpe:/a:redhat:rhel_e4s:8.4::appstream cpe:/a:redhat:rhel_aus:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Telecommunications Update Service	Unaffected: 0:1.11.0-8.el8_4.12 < * cpe:/a:redhat:rhel_tus:8.4::appstream cpe:/a:redhat:rhel_e4s:8.4::appstream cpe:/a:redhat:rhel_aus:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions	Unaffected: 0:1.11.0-8.el8_4.12 < * cpe:/a:redhat:rhel_tus:8.4::appstream cpe:/a:redhat:rhel_e4s:8.4::appstream cpe:/a:redhat:rhel_aus:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:1.12.0-6.el8_6.13 < * cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/a:redhat:rhel_aus:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	Unaffected: 0:1.12.0-6.el8_6.13 < * cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/a:redhat:rhel_aus:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	Unaffected: 0:1.12.0-6.el8_6.13 < * cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/a:redhat:rhel_aus:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	Unaffected: 0:1.12.0-15.el8_8.12 < * cpe:/a:redhat:rhel_eus:8.8::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:1.14.1-1.el9_5.1 < * cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	Unaffected: 0:1.11.0-22.el9_0.13 < * cpe:/a:redhat:rhel_e4s:9.0::appstream
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	Unaffected: 0:1.12.0-14.el9_2.10 < * cpe:/a:redhat:rhel_eus:9.2::appstream
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 0:1.13.1-8.el9_4.5 < * cpe:/a:redhat:rhel_eus:9.4::appstream
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2025-26595",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-25T20:05:05.924947Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-25T20:05:22.115Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               collectionURL: "https://gitlab.freedesktop.org/xorg/xserver/",
               defaultStatus: "unaffected",
               packageName: "xserver",
               versions: [
                  {
                     lessThan: "21.1.16",
                     status: "affected",
                     version: "0",
                     versionType: "semver",
                  },
                  {
                     lessThan: "24.1.6",
                     status: "affected",
                     version: "22.0.0",
                     versionType: "semver",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:rhel_els:7",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.8.0-36.el7_9",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:rhel_els:7",
               ],
               defaultStatus: "affected",
               packageName: "xorg-x11-server",
               product: "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.20.4-30.el7_9",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:enterprise_linux:8::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.13.1-15.el8_10",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_aus:8.2::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.2 Advanced Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.9.0-15.el8_2.13",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_tus:8.4::appstream",
                  "cpe:/a:redhat:rhel_e4s:8.4::appstream",
                  "cpe:/a:redhat:rhel_aus:8.4::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.11.0-8.el8_4.12",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_tus:8.4::appstream",
                  "cpe:/a:redhat:rhel_e4s:8.4::appstream",
                  "cpe:/a:redhat:rhel_aus:8.4::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.4 Telecommunications Update Service",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.11.0-8.el8_4.12",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_tus:8.4::appstream",
                  "cpe:/a:redhat:rhel_e4s:8.4::appstream",
                  "cpe:/a:redhat:rhel_aus:8.4::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.11.0-8.el8_4.12",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_e4s:8.6::appstream",
                  "cpe:/a:redhat:rhel_tus:8.6::appstream",
                  "cpe:/a:redhat:rhel_aus:8.6::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.12.0-6.el8_6.13",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_e4s:8.6::appstream",
                  "cpe:/a:redhat:rhel_tus:8.6::appstream",
                  "cpe:/a:redhat:rhel_aus:8.6::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.12.0-6.el8_6.13",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_e4s:8.6::appstream",
                  "cpe:/a:redhat:rhel_tus:8.6::appstream",
                  "cpe:/a:redhat:rhel_aus:8.6::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.12.0-6.el8_6.13",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_eus:8.8::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.8 Extended Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.12.0-15.el8_8.12",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:enterprise_linux:9::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 9",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.14.1-1.el9_5.1",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_e4s:9.0::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.11.0-22.el9_0.13",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_eus:9.2::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 9.2 Extended Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.12.0-14.el9_2.10",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_eus:9.4::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 9.4 Extended Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.13.1-8.el9_4.5",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:6",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:6",
               ],
               defaultStatus: "unknown",
               packageName: "xorg-x11-server",
               product: "Red Hat Enterprise Linux 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:8",
               ],
               defaultStatus: "unaffected",
               packageName: "xorg-x11-server",
               product: "Red Hat Enterprise Linux 8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:8",
               ],
               defaultStatus: "unaffected",
               packageName: "xorg-x11-server-Xwayland",
               product: "Red Hat Enterprise Linux 8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:9",
               ],
               defaultStatus: "affected",
               packageName: "xorg-x11-server",
               product: "Red Hat Enterprise Linux 9",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:9",
               ],
               defaultStatus: "affected",
               packageName: "xorg-x11-server-Xwayland",
               product: "Red Hat Enterprise Linux 9",
               vendor: "Red Hat",
            },
         ],
         datePublic: "2025-02-25T00:00:00.000Z",
         descriptions: [
            {
               lang: "en",
               value: "A buffer overflow flaw was found in X.Org and Xwayland. The code in XkbVModMaskText() allocates a fixed-sized buffer on the stack and copies the names of the virtual modifiers to that buffer. The code fails to check the bounds of the buffer and would copy the data regardless of the size.",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     namespace: "https://access.redhat.com/security/updates/classification/",
                     value: "Important",
                  },
                  type: "Red Hat severity rating",
               },
            },
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-121",
                     description: "Stack-based Buffer Overflow",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-03-27T04:19:56.000Z",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "RHSA-2025:2500",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2500",
            },
            {
               name: "RHSA-2025:2502",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2502",
            },
            {
               name: "RHSA-2025:2861",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2861",
            },
            {
               name: "RHSA-2025:2862",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2862",
            },
            {
               name: "RHSA-2025:2865",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2865",
            },
            {
               name: "RHSA-2025:2866",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2866",
            },
            {
               name: "RHSA-2025:2873",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2873",
            },
            {
               name: "RHSA-2025:2874",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2874",
            },
            {
               name: "RHSA-2025:2875",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2875",
            },
            {
               name: "RHSA-2025:2879",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2879",
            },
            {
               name: "RHSA-2025:2880",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2880",
            },
            {
               tags: [
                  "vdb-entry",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/security/cve/CVE-2025-26595",
            },
            {
               name: "RHBZ#2345257",
               tags: [
                  "issue-tracking",
                  "x_refsource_REDHAT",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2345257",
            },
         ],
         timeline: [
            {
               lang: "en",
               time: "2025-02-12T14:15:00.929000+00:00",
               value: "Reported to Red Hat.",
            },
            {
               lang: "en",
               time: "2025-02-25T00:00:00+00:00",
               value: "Made public.",
            },
         ],
         title: "Xorg: xwayland: buffer overflow in xkbvmodmasktext()",
         workarounds: [
            {
               lang: "en",
               value: "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
            },
         ],
         x_redhatCweChain: "CWE-121: Stack-based Buffer Overflow",
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2025-26595",
      datePublished: "2025-02-25T15:54:06.708Z",
      dateReserved: "2025-02-12T14:12:22.795Z",
      dateUpdated: "2025-03-27T04:19:56.000Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2025-26601

Vulnerability from cvelistv5

Published

2025-02-25 15:55

Modified

2025-03-27 04:22

Severity ?

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

A use-after-free flaw was found in X.Org and Xwayland. When changing an alarm, the values of the change mask are evaluated one after the other, changing the trigger values as requested, and eventually, SyncInitTrigger() is called. If one of the changes triggers an error, the function will return early, not adding the new sync object, possibly causing a use-after-free when the alarm eventually triggers.

References

▼	URL	Tags
	https://access.redhat.com/errata/RHSA-2025:2500	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2502	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2861	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2862	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2865	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2866	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2873	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2874	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2875	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2879	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2880	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/security/cve/CVE-2025-26601	vdb-entry, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2345251	issue-tracking, x_refsource_REDHAT

Impacted products

Vendor

Product

Version

▼

Version: 0 ≤
Version: 22.0.0 ≤

Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:1.8.0-36.el7_9 < * cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:1.20.4-30.el7_9 < * cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:1.13.1-15.el8_10 < * cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	Unaffected: 0:1.9.0-15.el8_2.13 < * cpe:/a:redhat:rhel_aus:8.2::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:1.11.0-8.el8_4.12 < * cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_tus:8.4::appstream cpe:/a:redhat:rhel_e4s:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Telecommunications Update Service	Unaffected: 0:1.11.0-8.el8_4.12 < * cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_tus:8.4::appstream cpe:/a:redhat:rhel_e4s:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions	Unaffected: 0:1.11.0-8.el8_4.12 < * cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_tus:8.4::appstream cpe:/a:redhat:rhel_e4s:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:1.12.0-6.el8_6.13 < * cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/a:redhat:rhel_e4s:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	Unaffected: 0:1.12.0-6.el8_6.13 < * cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/a:redhat:rhel_e4s:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	Unaffected: 0:1.12.0-6.el8_6.13 < * cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/a:redhat:rhel_e4s:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	Unaffected: 0:1.12.0-15.el8_8.12 < * cpe:/a:redhat:rhel_eus:8.8::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:1.14.1-1.el9_5.1 < * cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	Unaffected: 0:1.11.0-22.el9_0.13 < * cpe:/a:redhat:rhel_e4s:9.0::appstream
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	Unaffected: 0:1.12.0-14.el9_2.10 < * cpe:/a:redhat:rhel_eus:9.2::appstream
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 0:1.13.1-8.el9_4.5 < * cpe:/a:redhat:rhel_eus:9.4::appstream
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2025-26601",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-25T16:08:41.554166Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-25T16:08:49.344Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               collectionURL: "https://gitlab.freedesktop.org/xorg/xserver/",
               defaultStatus: "unaffected",
               packageName: "xserver",
               versions: [
                  {
                     lessThan: "21.1.16",
                     status: "affected",
                     version: "0",
                     versionType: "semver",
                  },
                  {
                     lessThan: "24.1.6",
                     status: "affected",
                     version: "22.0.0",
                     versionType: "semver",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:rhel_els:7",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.8.0-36.el7_9",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:rhel_els:7",
               ],
               defaultStatus: "affected",
               packageName: "xorg-x11-server",
               product: "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.20.4-30.el7_9",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:enterprise_linux:8::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.13.1-15.el8_10",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_aus:8.2::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.2 Advanced Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.9.0-15.el8_2.13",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_aus:8.4::appstream",
                  "cpe:/a:redhat:rhel_tus:8.4::appstream",
                  "cpe:/a:redhat:rhel_e4s:8.4::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.11.0-8.el8_4.12",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_aus:8.4::appstream",
                  "cpe:/a:redhat:rhel_tus:8.4::appstream",
                  "cpe:/a:redhat:rhel_e4s:8.4::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.4 Telecommunications Update Service",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.11.0-8.el8_4.12",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_aus:8.4::appstream",
                  "cpe:/a:redhat:rhel_tus:8.4::appstream",
                  "cpe:/a:redhat:rhel_e4s:8.4::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.11.0-8.el8_4.12",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_aus:8.6::appstream",
                  "cpe:/a:redhat:rhel_tus:8.6::appstream",
                  "cpe:/a:redhat:rhel_e4s:8.6::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.12.0-6.el8_6.13",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_aus:8.6::appstream",
                  "cpe:/a:redhat:rhel_tus:8.6::appstream",
                  "cpe:/a:redhat:rhel_e4s:8.6::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.12.0-6.el8_6.13",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_aus:8.6::appstream",
                  "cpe:/a:redhat:rhel_tus:8.6::appstream",
                  "cpe:/a:redhat:rhel_e4s:8.6::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.12.0-6.el8_6.13",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_eus:8.8::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.8 Extended Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.12.0-15.el8_8.12",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:enterprise_linux:9::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 9",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.14.1-1.el9_5.1",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_e4s:9.0::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.11.0-22.el9_0.13",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_eus:9.2::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 9.2 Extended Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.12.0-14.el9_2.10",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_eus:9.4::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 9.4 Extended Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.13.1-8.el9_4.5",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:6",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:6",
               ],
               defaultStatus: "unknown",
               packageName: "xorg-x11-server",
               product: "Red Hat Enterprise Linux 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:8",
               ],
               defaultStatus: "unaffected",
               packageName: "xorg-x11-server",
               product: "Red Hat Enterprise Linux 8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:8",
               ],
               defaultStatus: "unaffected",
               packageName: "xorg-x11-server-Xwayland",
               product: "Red Hat Enterprise Linux 8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:9",
               ],
               defaultStatus: "affected",
               packageName: "xorg-x11-server",
               product: "Red Hat Enterprise Linux 9",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:9",
               ],
               defaultStatus: "affected",
               packageName: "xorg-x11-server-Xwayland",
               product: "Red Hat Enterprise Linux 9",
               vendor: "Red Hat",
            },
         ],
         datePublic: "2025-02-25T00:00:00.000Z",
         descriptions: [
            {
               lang: "en",
               value: "A use-after-free flaw was found in X.Org and Xwayland. When changing an alarm, the values of the change mask are evaluated one after the other, changing the trigger values as requested, and eventually, SyncInitTrigger() is called. If one of the changes triggers an error, the function will return early, not adding the new sync object, possibly causing a use-after-free when the alarm eventually triggers.",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     namespace: "https://access.redhat.com/security/updates/classification/",
                     value: "Important",
                  },
                  type: "Red Hat severity rating",
               },
            },
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-416",
                     description: "Use After Free",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-03-27T04:22:08.108Z",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "RHSA-2025:2500",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2500",
            },
            {
               name: "RHSA-2025:2502",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2502",
            },
            {
               name: "RHSA-2025:2861",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2861",
            },
            {
               name: "RHSA-2025:2862",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2862",
            },
            {
               name: "RHSA-2025:2865",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2865",
            },
            {
               name: "RHSA-2025:2866",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2866",
            },
            {
               name: "RHSA-2025:2873",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2873",
            },
            {
               name: "RHSA-2025:2874",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2874",
            },
            {
               name: "RHSA-2025:2875",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2875",
            },
            {
               name: "RHSA-2025:2879",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2879",
            },
            {
               name: "RHSA-2025:2880",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2880",
            },
            {
               tags: [
                  "vdb-entry",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/security/cve/CVE-2025-26601",
            },
            {
               name: "RHBZ#2345251",
               tags: [
                  "issue-tracking",
                  "x_refsource_REDHAT",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2345251",
            },
         ],
         timeline: [
            {
               lang: "en",
               time: "2025-02-12T14:18:30.820000+00:00",
               value: "Reported to Red Hat.",
            },
            {
               lang: "en",
               time: "2025-02-25T00:00:00+00:00",
               value: "Made public.",
            },
         ],
         title: "Xorg: xwayland: use-after-free in syncinittrigger()",
         workarounds: [
            {
               lang: "en",
               value: "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
            },
         ],
         x_redhatCweChain: "CWE-416: Use After Free",
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2025-26601",
      datePublished: "2025-02-25T15:55:36.775Z",
      dateReserved: "2025-02-12T14:12:22.796Z",
      dateUpdated: "2025-03-27T04:22:08.108Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2025-26596

Vulnerability from cvelistv5

Published

2025-02-25 15:54

Modified

2025-03-27 04:20

Severity ?

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

A heap overflow flaw was found in X.Org and Xwayland. The computation of the length in XkbSizeKeySyms() differs from what is written in XkbWriteKeySyms(), which may lead to a heap-based buffer overflow.

References

▼	URL	Tags
	https://access.redhat.com/errata/RHSA-2025:2500	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2502	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2861	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2862	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2865	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2866	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2873	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2874	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2875	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2879	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2880	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/security/cve/CVE-2025-26596	vdb-entry, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2345256	issue-tracking, x_refsource_REDHAT

Impacted products

Vendor

Product

Version

▼

Version: 0 ≤
Version: 22.0.0 ≤

Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:1.8.0-36.el7_9 < * cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:1.20.4-30.el7_9 < * cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:1.13.1-15.el8_10 < * cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	Unaffected: 0:1.9.0-15.el8_2.13 < * cpe:/a:redhat:rhel_aus:8.2::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:1.11.0-8.el8_4.12 < * cpe:/a:redhat:rhel_e4s:8.4::appstream cpe:/a:redhat:rhel_tus:8.4::appstream cpe:/a:redhat:rhel_aus:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Telecommunications Update Service	Unaffected: 0:1.11.0-8.el8_4.12 < * cpe:/a:redhat:rhel_e4s:8.4::appstream cpe:/a:redhat:rhel_tus:8.4::appstream cpe:/a:redhat:rhel_aus:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions	Unaffected: 0:1.11.0-8.el8_4.12 < * cpe:/a:redhat:rhel_e4s:8.4::appstream cpe:/a:redhat:rhel_tus:8.4::appstream cpe:/a:redhat:rhel_aus:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:1.12.0-6.el8_6.13 < * cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	Unaffected: 0:1.12.0-6.el8_6.13 < * cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	Unaffected: 0:1.12.0-6.el8_6.13 < * cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	Unaffected: 0:1.12.0-15.el8_8.12 < * cpe:/a:redhat:rhel_eus:8.8::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:1.14.1-1.el9_5.1 < * cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	Unaffected: 0:1.11.0-22.el9_0.13 < * cpe:/a:redhat:rhel_e4s:9.0::appstream
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	Unaffected: 0:1.12.0-14.el9_2.10 < * cpe:/a:redhat:rhel_eus:9.2::appstream
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 0:1.13.1-8.el9_4.5 < * cpe:/a:redhat:rhel_eus:9.4::appstream
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2025-26596",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-25T17:14:01.432188Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-25T17:22:27.580Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               collectionURL: "https://gitlab.freedesktop.org/xorg/xserver/",
               defaultStatus: "unaffected",
               packageName: "xserver",
               versions: [
                  {
                     lessThan: "21.1.16",
                     status: "affected",
                     version: "0",
                     versionType: "semver",
                  },
                  {
                     lessThan: "24.1.6",
                     status: "affected",
                     version: "22.0.0",
                     versionType: "semver",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:rhel_els:7",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.8.0-36.el7_9",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:rhel_els:7",
               ],
               defaultStatus: "affected",
               packageName: "xorg-x11-server",
               product: "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.20.4-30.el7_9",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:enterprise_linux:8::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.13.1-15.el8_10",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_aus:8.2::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.2 Advanced Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.9.0-15.el8_2.13",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_e4s:8.4::appstream",
                  "cpe:/a:redhat:rhel_tus:8.4::appstream",
                  "cpe:/a:redhat:rhel_aus:8.4::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.11.0-8.el8_4.12",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_e4s:8.4::appstream",
                  "cpe:/a:redhat:rhel_tus:8.4::appstream",
                  "cpe:/a:redhat:rhel_aus:8.4::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.4 Telecommunications Update Service",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.11.0-8.el8_4.12",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_e4s:8.4::appstream",
                  "cpe:/a:redhat:rhel_tus:8.4::appstream",
                  "cpe:/a:redhat:rhel_aus:8.4::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.11.0-8.el8_4.12",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_e4s:8.6::appstream",
                  "cpe:/a:redhat:rhel_aus:8.6::appstream",
                  "cpe:/a:redhat:rhel_tus:8.6::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.12.0-6.el8_6.13",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_e4s:8.6::appstream",
                  "cpe:/a:redhat:rhel_aus:8.6::appstream",
                  "cpe:/a:redhat:rhel_tus:8.6::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.12.0-6.el8_6.13",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_e4s:8.6::appstream",
                  "cpe:/a:redhat:rhel_aus:8.6::appstream",
                  "cpe:/a:redhat:rhel_tus:8.6::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.12.0-6.el8_6.13",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_eus:8.8::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.8 Extended Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.12.0-15.el8_8.12",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:enterprise_linux:9::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 9",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.14.1-1.el9_5.1",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_e4s:9.0::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.11.0-22.el9_0.13",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_eus:9.2::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 9.2 Extended Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.12.0-14.el9_2.10",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_eus:9.4::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 9.4 Extended Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.13.1-8.el9_4.5",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:6",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:6",
               ],
               defaultStatus: "unknown",
               packageName: "xorg-x11-server",
               product: "Red Hat Enterprise Linux 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:8",
               ],
               defaultStatus: "unaffected",
               packageName: "xorg-x11-server",
               product: "Red Hat Enterprise Linux 8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:8",
               ],
               defaultStatus: "unaffected",
               packageName: "xorg-x11-server-Xwayland",
               product: "Red Hat Enterprise Linux 8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:9",
               ],
               defaultStatus: "affected",
               packageName: "xorg-x11-server",
               product: "Red Hat Enterprise Linux 9",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:9",
               ],
               defaultStatus: "affected",
               packageName: "xorg-x11-server-Xwayland",
               product: "Red Hat Enterprise Linux 9",
               vendor: "Red Hat",
            },
         ],
         datePublic: "2025-02-25T00:00:00.000Z",
         descriptions: [
            {
               lang: "en",
               value: "A heap overflow flaw was found in X.Org and Xwayland. The computation of the length in XkbSizeKeySyms() differs from what is written in XkbWriteKeySyms(), which may lead to a heap-based buffer overflow.",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     namespace: "https://access.redhat.com/security/updates/classification/",
                     value: "Important",
                  },
                  type: "Red Hat severity rating",
               },
            },
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-787",
                     description: "Out-of-bounds Write",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-03-27T04:20:12.127Z",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "RHSA-2025:2500",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2500",
            },
            {
               name: "RHSA-2025:2502",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2502",
            },
            {
               name: "RHSA-2025:2861",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2861",
            },
            {
               name: "RHSA-2025:2862",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2862",
            },
            {
               name: "RHSA-2025:2865",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2865",
            },
            {
               name: "RHSA-2025:2866",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2866",
            },
            {
               name: "RHSA-2025:2873",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2873",
            },
            {
               name: "RHSA-2025:2874",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2874",
            },
            {
               name: "RHSA-2025:2875",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2875",
            },
            {
               name: "RHSA-2025:2879",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2879",
            },
            {
               name: "RHSA-2025:2880",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2880",
            },
            {
               tags: [
                  "vdb-entry",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/security/cve/CVE-2025-26596",
            },
            {
               name: "RHBZ#2345256",
               tags: [
                  "issue-tracking",
                  "x_refsource_REDHAT",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2345256",
            },
         ],
         timeline: [
            {
               lang: "en",
               time: "2025-02-12T14:15:01.367000+00:00",
               value: "Reported to Red Hat.",
            },
            {
               lang: "en",
               time: "2025-02-25T00:00:00+00:00",
               value: "Made public.",
            },
         ],
         title: "Xorg: xwayland: heap overflow in xkbwritekeysyms()",
         workarounds: [
            {
               lang: "en",
               value: "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
            },
         ],
         x_redhatCweChain: "CWE-787: Out-of-bounds Write",
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2025-26596",
      datePublished: "2025-02-25T15:54:23.693Z",
      dateReserved: "2025-02-12T14:12:22.795Z",
      dateUpdated: "2025-03-27T04:20:12.127Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2025-26600

Vulnerability from cvelistv5

Published

2025-02-25 15:55

Modified

2025-03-27 04:21

Severity ?

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

A use-after-free flaw was found in X.Org and Xwayland. When a device is removed while still frozen, the events queued for that device remain while the device is freed. Replaying the events will cause a use-after-free.

References

▼	URL	Tags
	https://access.redhat.com/errata/RHSA-2025:2500	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2502	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2861	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2862	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2865	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2866	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2873	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2874	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2875	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2879	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2880	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/security/cve/CVE-2025-26600	vdb-entry, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2345252	issue-tracking, x_refsource_REDHAT

Impacted products

Vendor

Product

Version

▼

Version: 0 ≤
Version: 22.0.0 ≤

Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:1.8.0-36.el7_9 < * cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:1.20.4-30.el7_9 < * cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:1.13.1-15.el8_10 < * cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	Unaffected: 0:1.9.0-15.el8_2.13 < * cpe:/a:redhat:rhel_aus:8.2::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:1.11.0-8.el8_4.12 < * cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_tus:8.4::appstream cpe:/a:redhat:rhel_e4s:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Telecommunications Update Service	Unaffected: 0:1.11.0-8.el8_4.12 < * cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_tus:8.4::appstream cpe:/a:redhat:rhel_e4s:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions	Unaffected: 0:1.11.0-8.el8_4.12 < * cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_tus:8.4::appstream cpe:/a:redhat:rhel_e4s:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:1.12.0-6.el8_6.13 < * cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/a:redhat:rhel_e4s:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	Unaffected: 0:1.12.0-6.el8_6.13 < * cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/a:redhat:rhel_e4s:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	Unaffected: 0:1.12.0-6.el8_6.13 < * cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/a:redhat:rhel_e4s:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	Unaffected: 0:1.12.0-15.el8_8.12 < * cpe:/a:redhat:rhel_eus:8.8::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:1.14.1-1.el9_5.1 < * cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	Unaffected: 0:1.11.0-22.el9_0.13 < * cpe:/a:redhat:rhel_e4s:9.0::appstream
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	Unaffected: 0:1.12.0-14.el9_2.10 < * cpe:/a:redhat:rhel_eus:9.2::appstream
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 0:1.13.1-8.el9_4.5 < * cpe:/a:redhat:rhel_eus:9.4::appstream
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2025-26600",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-25T16:16:54.221297Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-25T16:17:05.872Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               collectionURL: "https://gitlab.freedesktop.org/xorg/xserver/",
               defaultStatus: "unaffected",
               packageName: "xserver",
               versions: [
                  {
                     lessThan: "21.1.16",
                     status: "affected",
                     version: "0",
                     versionType: "semver",
                  },
                  {
                     lessThan: "24.1.6",
                     status: "affected",
                     version: "22.0.0",
                     versionType: "semver",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:rhel_els:7",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.8.0-36.el7_9",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:rhel_els:7",
               ],
               defaultStatus: "affected",
               packageName: "xorg-x11-server",
               product: "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.20.4-30.el7_9",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:enterprise_linux:8::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.13.1-15.el8_10",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_aus:8.2::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.2 Advanced Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.9.0-15.el8_2.13",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_aus:8.4::appstream",
                  "cpe:/a:redhat:rhel_tus:8.4::appstream",
                  "cpe:/a:redhat:rhel_e4s:8.4::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.11.0-8.el8_4.12",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_aus:8.4::appstream",
                  "cpe:/a:redhat:rhel_tus:8.4::appstream",
                  "cpe:/a:redhat:rhel_e4s:8.4::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.4 Telecommunications Update Service",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.11.0-8.el8_4.12",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_aus:8.4::appstream",
                  "cpe:/a:redhat:rhel_tus:8.4::appstream",
                  "cpe:/a:redhat:rhel_e4s:8.4::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.11.0-8.el8_4.12",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_aus:8.6::appstream",
                  "cpe:/a:redhat:rhel_tus:8.6::appstream",
                  "cpe:/a:redhat:rhel_e4s:8.6::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.12.0-6.el8_6.13",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_aus:8.6::appstream",
                  "cpe:/a:redhat:rhel_tus:8.6::appstream",
                  "cpe:/a:redhat:rhel_e4s:8.6::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.12.0-6.el8_6.13",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_aus:8.6::appstream",
                  "cpe:/a:redhat:rhel_tus:8.6::appstream",
                  "cpe:/a:redhat:rhel_e4s:8.6::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.12.0-6.el8_6.13",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_eus:8.8::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.8 Extended Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.12.0-15.el8_8.12",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:enterprise_linux:9::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 9",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.14.1-1.el9_5.1",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_e4s:9.0::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.11.0-22.el9_0.13",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_eus:9.2::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 9.2 Extended Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.12.0-14.el9_2.10",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_eus:9.4::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 9.4 Extended Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.13.1-8.el9_4.5",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:6",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:6",
               ],
               defaultStatus: "unknown",
               packageName: "xorg-x11-server",
               product: "Red Hat Enterprise Linux 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:8",
               ],
               defaultStatus: "unaffected",
               packageName: "xorg-x11-server",
               product: "Red Hat Enterprise Linux 8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:8",
               ],
               defaultStatus: "unaffected",
               packageName: "xorg-x11-server-Xwayland",
               product: "Red Hat Enterprise Linux 8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:9",
               ],
               defaultStatus: "affected",
               packageName: "xorg-x11-server",
               product: "Red Hat Enterprise Linux 9",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:9",
               ],
               defaultStatus: "affected",
               packageName: "xorg-x11-server-Xwayland",
               product: "Red Hat Enterprise Linux 9",
               vendor: "Red Hat",
            },
         ],
         datePublic: "2025-02-25T00:00:00.000Z",
         descriptions: [
            {
               lang: "en",
               value: "A use-after-free flaw was found in X.Org and Xwayland. When a device is removed while still frozen, the events queued for that device remain while the device is freed. Replaying the events will cause a use-after-free.",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     namespace: "https://access.redhat.com/security/updates/classification/",
                     value: "Important",
                  },
                  type: "Red Hat severity rating",
               },
            },
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-416",
                     description: "Use After Free",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-03-27T04:21:52.306Z",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "RHSA-2025:2500",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2500",
            },
            {
               name: "RHSA-2025:2502",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2502",
            },
            {
               name: "RHSA-2025:2861",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2861",
            },
            {
               name: "RHSA-2025:2862",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2862",
            },
            {
               name: "RHSA-2025:2865",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2865",
            },
            {
               name: "RHSA-2025:2866",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2866",
            },
            {
               name: "RHSA-2025:2873",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2873",
            },
            {
               name: "RHSA-2025:2874",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2874",
            },
            {
               name: "RHSA-2025:2875",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2875",
            },
            {
               name: "RHSA-2025:2879",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2879",
            },
            {
               name: "RHSA-2025:2880",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2880",
            },
            {
               tags: [
                  "vdb-entry",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/security/cve/CVE-2025-26600",
            },
            {
               name: "RHBZ#2345252",
               tags: [
                  "issue-tracking",
                  "x_refsource_REDHAT",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2345252",
            },
         ],
         timeline: [
            {
               lang: "en",
               time: "2025-02-12T14:15:01.957000+00:00",
               value: "Reported to Red Hat.",
            },
            {
               lang: "en",
               time: "2025-02-25T00:00:00+00:00",
               value: "Made public.",
            },
         ],
         title: "Xorg: xwayland: use-after-free in playreleasedevents()",
         workarounds: [
            {
               lang: "en",
               value: "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
            },
         ],
         x_redhatCweChain: "CWE-416: Use After Free",
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2025-26600",
      datePublished: "2025-02-25T15:55:20.421Z",
      dateReserved: "2025-02-12T14:12:22.796Z",
      dateUpdated: "2025-03-27T04:21:52.306Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2025-26597

Vulnerability from cvelistv5

Published

2025-02-25 15:54

Modified

2025-03-27 04:20

Severity ?

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

A buffer overflow flaw was found in X.Org and Xwayland. If XkbChangeTypesOfKey() is called with a 0 group, it will resize the key symbols table to 0 but leave the key actions unchanged. If the same function is later called with a non-zero value of groups, this will cause a buffer overflow because the key actions are of the wrong size.

References

▼	URL	Tags
	https://access.redhat.com/errata/RHSA-2025:2500	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2502	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2861	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2862	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2865	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2866	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2873	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2874	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2875	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2879	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2880	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/security/cve/CVE-2025-26597	vdb-entry, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2345255	issue-tracking, x_refsource_REDHAT

Impacted products

Vendor

Product

Version

▼

Version: 0 ≤
Version: 22.0.0 ≤

Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:1.8.0-36.el7_9 < * cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:1.20.4-30.el7_9 < * cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:1.13.1-15.el8_10 < * cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	Unaffected: 0:1.9.0-15.el8_2.13 < * cpe:/a:redhat:rhel_aus:8.2::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:1.11.0-8.el8_4.12 < * cpe:/a:redhat:rhel_tus:8.4::appstream cpe:/a:redhat:rhel_e4s:8.4::appstream cpe:/a:redhat:rhel_aus:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Telecommunications Update Service	Unaffected: 0:1.11.0-8.el8_4.12 < * cpe:/a:redhat:rhel_tus:8.4::appstream cpe:/a:redhat:rhel_e4s:8.4::appstream cpe:/a:redhat:rhel_aus:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions	Unaffected: 0:1.11.0-8.el8_4.12 < * cpe:/a:redhat:rhel_tus:8.4::appstream cpe:/a:redhat:rhel_e4s:8.4::appstream cpe:/a:redhat:rhel_aus:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:1.12.0-6.el8_6.13 < * cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/a:redhat:rhel_aus:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	Unaffected: 0:1.12.0-6.el8_6.13 < * cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/a:redhat:rhel_aus:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	Unaffected: 0:1.12.0-6.el8_6.13 < * cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/a:redhat:rhel_aus:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	Unaffected: 0:1.12.0-15.el8_8.12 < * cpe:/a:redhat:rhel_eus:8.8::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:1.14.1-1.el9_5.1 < * cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	Unaffected: 0:1.11.0-22.el9_0.13 < * cpe:/a:redhat:rhel_e4s:9.0::appstream
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	Unaffected: 0:1.12.0-14.el9_2.10 < * cpe:/a:redhat:rhel_eus:9.2::appstream
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 0:1.13.1-8.el9_4.5 < * cpe:/a:redhat:rhel_eus:9.4::appstream
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2025-26597",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-25T16:39:35.677718Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-25T19:14:54.385Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               collectionURL: "https://gitlab.freedesktop.org/xorg/xserver/",
               defaultStatus: "unaffected",
               packageName: "xserver",
               versions: [
                  {
                     lessThan: "21.1.16",
                     status: "affected",
                     version: "0",
                     versionType: "semver",
                  },
                  {
                     lessThan: "24.1.6",
                     status: "affected",
                     version: "22.0.0",
                     versionType: "semver",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:rhel_els:7",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.8.0-36.el7_9",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:rhel_els:7",
               ],
               defaultStatus: "affected",
               packageName: "xorg-x11-server",
               product: "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.20.4-30.el7_9",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:enterprise_linux:8::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.13.1-15.el8_10",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_aus:8.2::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.2 Advanced Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.9.0-15.el8_2.13",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_tus:8.4::appstream",
                  "cpe:/a:redhat:rhel_e4s:8.4::appstream",
                  "cpe:/a:redhat:rhel_aus:8.4::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.11.0-8.el8_4.12",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_tus:8.4::appstream",
                  "cpe:/a:redhat:rhel_e4s:8.4::appstream",
                  "cpe:/a:redhat:rhel_aus:8.4::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.4 Telecommunications Update Service",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.11.0-8.el8_4.12",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_tus:8.4::appstream",
                  "cpe:/a:redhat:rhel_e4s:8.4::appstream",
                  "cpe:/a:redhat:rhel_aus:8.4::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.11.0-8.el8_4.12",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_e4s:8.6::appstream",
                  "cpe:/a:redhat:rhel_tus:8.6::appstream",
                  "cpe:/a:redhat:rhel_aus:8.6::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.12.0-6.el8_6.13",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_e4s:8.6::appstream",
                  "cpe:/a:redhat:rhel_tus:8.6::appstream",
                  "cpe:/a:redhat:rhel_aus:8.6::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.12.0-6.el8_6.13",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_e4s:8.6::appstream",
                  "cpe:/a:redhat:rhel_tus:8.6::appstream",
                  "cpe:/a:redhat:rhel_aus:8.6::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.12.0-6.el8_6.13",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_eus:8.8::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.8 Extended Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.12.0-15.el8_8.12",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:enterprise_linux:9::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 9",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.14.1-1.el9_5.1",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_e4s:9.0::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.11.0-22.el9_0.13",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_eus:9.2::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 9.2 Extended Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.12.0-14.el9_2.10",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_eus:9.4::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 9.4 Extended Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.13.1-8.el9_4.5",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:6",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:6",
               ],
               defaultStatus: "unknown",
               packageName: "xorg-x11-server",
               product: "Red Hat Enterprise Linux 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:8",
               ],
               defaultStatus: "unaffected",
               packageName: "xorg-x11-server",
               product: "Red Hat Enterprise Linux 8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:8",
               ],
               defaultStatus: "unaffected",
               packageName: "xorg-x11-server-Xwayland",
               product: "Red Hat Enterprise Linux 8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:9",
               ],
               defaultStatus: "affected",
               packageName: "xorg-x11-server",
               product: "Red Hat Enterprise Linux 9",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:9",
               ],
               defaultStatus: "affected",
               packageName: "xorg-x11-server-Xwayland",
               product: "Red Hat Enterprise Linux 9",
               vendor: "Red Hat",
            },
         ],
         datePublic: "2025-02-25T00:00:00.000Z",
         descriptions: [
            {
               lang: "en",
               value: "A buffer overflow flaw was found in X.Org and Xwayland. If XkbChangeTypesOfKey() is called with a 0 group, it will resize the key symbols table to 0 but leave the key actions unchanged. If the same function is later called with a non-zero value of groups, this will cause a buffer overflow because the key actions are of the wrong size.",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     namespace: "https://access.redhat.com/security/updates/classification/",
                     value: "Important",
                  },
                  type: "Red Hat severity rating",
               },
            },
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-119",
                     description: "Improper Restriction of Operations within the Bounds of a Memory Buffer",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-03-27T04:20:29.448Z",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "RHSA-2025:2500",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2500",
            },
            {
               name: "RHSA-2025:2502",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2502",
            },
            {
               name: "RHSA-2025:2861",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2861",
            },
            {
               name: "RHSA-2025:2862",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2862",
            },
            {
               name: "RHSA-2025:2865",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2865",
            },
            {
               name: "RHSA-2025:2866",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2866",
            },
            {
               name: "RHSA-2025:2873",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2873",
            },
            {
               name: "RHSA-2025:2874",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2874",
            },
            {
               name: "RHSA-2025:2875",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2875",
            },
            {
               name: "RHSA-2025:2879",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2879",
            },
            {
               name: "RHSA-2025:2880",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2880",
            },
            {
               tags: [
                  "vdb-entry",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/security/cve/CVE-2025-26597",
            },
            {
               name: "RHBZ#2345255",
               tags: [
                  "issue-tracking",
                  "x_refsource_REDHAT",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2345255",
            },
         ],
         timeline: [
            {
               lang: "en",
               time: "2025-02-12T14:15:01.517000+00:00",
               value: "Reported to Red Hat.",
            },
            {
               lang: "en",
               time: "2025-02-25T00:00:00+00:00",
               value: "Made public.",
            },
         ],
         title: "Xorg: xwayland: buffer overflow in xkbchangetypesofkey()",
         workarounds: [
            {
               lang: "en",
               value: "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
            },
         ],
         x_redhatCweChain: "CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer",
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2025-26597",
      datePublished: "2025-02-25T15:54:48.196Z",
      dateReserved: "2025-02-12T14:12:22.795Z",
      dateUpdated: "2025-03-27T04:20:29.448Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2025-26599

Vulnerability from cvelistv5

Published

2025-02-25 15:55

Modified

2025-03-27 04:21

Severity ?

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

An access to an uninitialized pointer flaw was found in X.Org and Xwayland. The function compCheckRedirect() may fail if it cannot allocate the backing pixmap. In that case, compRedirectWindow() will return a BadAlloc error without validating the window tree marked just before, which leaves the validated data partly initialized and the use of an uninitialized pointer later.

References

▼	URL	Tags
	https://access.redhat.com/errata/RHSA-2025:2500	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2502	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2861	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2862	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2865	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2866	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2873	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2874	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2875	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2879	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2880	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/security/cve/CVE-2025-26599	vdb-entry, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2345253	issue-tracking, x_refsource_REDHAT

Impacted products

Vendor

Product

Version

▼

Version: 0 ≤
Version: 22.0.0 ≤

Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:1.8.0-36.el7_9 < * cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:1.20.4-30.el7_9 < * cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:1.13.1-15.el8_10 < * cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	Unaffected: 0:1.9.0-15.el8_2.13 < * cpe:/a:redhat:rhel_aus:8.2::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:1.11.0-8.el8_4.12 < * cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_tus:8.4::appstream cpe:/a:redhat:rhel_e4s:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Telecommunications Update Service	Unaffected: 0:1.11.0-8.el8_4.12 < * cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_tus:8.4::appstream cpe:/a:redhat:rhel_e4s:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions	Unaffected: 0:1.11.0-8.el8_4.12 < * cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_tus:8.4::appstream cpe:/a:redhat:rhel_e4s:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:1.12.0-6.el8_6.13 < * cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/a:redhat:rhel_e4s:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	Unaffected: 0:1.12.0-6.el8_6.13 < * cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/a:redhat:rhel_e4s:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	Unaffected: 0:1.12.0-6.el8_6.13 < * cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/a:redhat:rhel_e4s:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	Unaffected: 0:1.12.0-15.el8_8.12 < * cpe:/a:redhat:rhel_eus:8.8::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:1.14.1-1.el9_5.1 < * cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	Unaffected: 0:1.11.0-22.el9_0.13 < * cpe:/a:redhat:rhel_e4s:9.0::appstream
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	Unaffected: 0:1.12.0-14.el9_2.10 < * cpe:/a:redhat:rhel_eus:9.2::appstream
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 0:1.13.1-8.el9_4.5 < * cpe:/a:redhat:rhel_eus:9.4::appstream
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2025-26599",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-25T16:22:35.562208Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-25T16:22:51.245Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               collectionURL: "https://gitlab.freedesktop.org/xorg/xserver/",
               defaultStatus: "unaffected",
               packageName: "xserver",
               versions: [
                  {
                     lessThan: "21.1.16",
                     status: "affected",
                     version: "0",
                     versionType: "semver",
                  },
                  {
                     lessThan: "24.1.6",
                     status: "affected",
                     version: "22.0.0",
                     versionType: "semver",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:rhel_els:7",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.8.0-36.el7_9",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:rhel_els:7",
               ],
               defaultStatus: "affected",
               packageName: "xorg-x11-server",
               product: "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.20.4-30.el7_9",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:enterprise_linux:8::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.13.1-15.el8_10",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_aus:8.2::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.2 Advanced Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.9.0-15.el8_2.13",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_aus:8.4::appstream",
                  "cpe:/a:redhat:rhel_tus:8.4::appstream",
                  "cpe:/a:redhat:rhel_e4s:8.4::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.11.0-8.el8_4.12",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_aus:8.4::appstream",
                  "cpe:/a:redhat:rhel_tus:8.4::appstream",
                  "cpe:/a:redhat:rhel_e4s:8.4::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.4 Telecommunications Update Service",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.11.0-8.el8_4.12",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_aus:8.4::appstream",
                  "cpe:/a:redhat:rhel_tus:8.4::appstream",
                  "cpe:/a:redhat:rhel_e4s:8.4::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.11.0-8.el8_4.12",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_aus:8.6::appstream",
                  "cpe:/a:redhat:rhel_tus:8.6::appstream",
                  "cpe:/a:redhat:rhel_e4s:8.6::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.12.0-6.el8_6.13",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_aus:8.6::appstream",
                  "cpe:/a:redhat:rhel_tus:8.6::appstream",
                  "cpe:/a:redhat:rhel_e4s:8.6::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.12.0-6.el8_6.13",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_aus:8.6::appstream",
                  "cpe:/a:redhat:rhel_tus:8.6::appstream",
                  "cpe:/a:redhat:rhel_e4s:8.6::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.12.0-6.el8_6.13",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_eus:8.8::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.8 Extended Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.12.0-15.el8_8.12",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:enterprise_linux:9::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 9",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.14.1-1.el9_5.1",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_e4s:9.0::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.11.0-22.el9_0.13",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_eus:9.2::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 9.2 Extended Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.12.0-14.el9_2.10",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_eus:9.4::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 9.4 Extended Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.13.1-8.el9_4.5",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:6",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:6",
               ],
               defaultStatus: "unknown",
               packageName: "xorg-x11-server",
               product: "Red Hat Enterprise Linux 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:8",
               ],
               defaultStatus: "unaffected",
               packageName: "xorg-x11-server",
               product: "Red Hat Enterprise Linux 8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:8",
               ],
               defaultStatus: "unaffected",
               packageName: "xorg-x11-server-Xwayland",
               product: "Red Hat Enterprise Linux 8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:9",
               ],
               defaultStatus: "affected",
               packageName: "xorg-x11-server",
               product: "Red Hat Enterprise Linux 9",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:9",
               ],
               defaultStatus: "affected",
               packageName: "xorg-x11-server-Xwayland",
               product: "Red Hat Enterprise Linux 9",
               vendor: "Red Hat",
            },
         ],
         datePublic: "2025-02-25T00:00:00.000Z",
         descriptions: [
            {
               lang: "en",
               value: "An access to an uninitialized pointer flaw was found in X.Org and Xwayland. The function compCheckRedirect() may fail if it cannot allocate the backing pixmap. In that case, compRedirectWindow() will return a BadAlloc error without validating the window tree marked just before, which leaves the validated data partly initialized and the use of an uninitialized pointer later.",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     namespace: "https://access.redhat.com/security/updates/classification/",
                     value: "Important",
                  },
                  type: "Red Hat severity rating",
               },
            },
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-824",
                     description: "Access of Uninitialized Pointer",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-03-27T04:21:07.505Z",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "RHSA-2025:2500",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2500",
            },
            {
               name: "RHSA-2025:2502",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2502",
            },
            {
               name: "RHSA-2025:2861",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2861",
            },
            {
               name: "RHSA-2025:2862",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2862",
            },
            {
               name: "RHSA-2025:2865",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2865",
            },
            {
               name: "RHSA-2025:2866",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2866",
            },
            {
               name: "RHSA-2025:2873",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2873",
            },
            {
               name: "RHSA-2025:2874",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2874",
            },
            {
               name: "RHSA-2025:2875",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2875",
            },
            {
               name: "RHSA-2025:2879",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2879",
            },
            {
               name: "RHSA-2025:2880",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2880",
            },
            {
               tags: [
                  "vdb-entry",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/security/cve/CVE-2025-26599",
            },
            {
               name: "RHBZ#2345253",
               tags: [
                  "issue-tracking",
                  "x_refsource_REDHAT",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2345253",
            },
         ],
         timeline: [
            {
               lang: "en",
               time: "2025-02-12T14:15:01.808000+00:00",
               value: "Reported to Red Hat.",
            },
            {
               lang: "en",
               time: "2025-02-25T00:00:00+00:00",
               value: "Made public.",
            },
         ],
         title: "Xorg: xwayland: use of uninitialized pointer in compredirectwindow()",
         workarounds: [
            {
               lang: "en",
               value: "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
            },
         ],
         x_redhatCweChain: "CWE-824: Access of Uninitialized Pointer",
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2025-26599",
      datePublished: "2025-02-25T15:55:02.964Z",
      dateReserved: "2025-02-12T14:12:22.796Z",
      dateUpdated: "2025-03-27T04:21:07.505Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2025-26598

Vulnerability from cvelistv5

Published

2025-02-25 15:54

Modified

2025-03-27 04:20

Severity ?

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

An out-of-bounds write flaw was found in X.Org and Xwayland. The function GetBarrierDevice() searches for the pointer device based on its device ID and returns the matching value, or supposedly NULL, if no match was found. However, the code will return the last element of the list if no matching device ID is found, which can lead to out-of-bounds memory access.

References

▼	URL	Tags
	https://access.redhat.com/errata/RHSA-2025:2500	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2502	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2861	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2862	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2865	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2866	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2873	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2874	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2875	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2879	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2880	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/security/cve/CVE-2025-26598	vdb-entry, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2345254	issue-tracking, x_refsource_REDHAT

Impacted products

Vendor

Product

Version

▼

Version: 0 ≤
Version: 22.0.0 ≤

Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:1.8.0-36.el7_9 < * cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:1.20.4-30.el7_9 < * cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:1.13.1-15.el8_10 < * cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	Unaffected: 0:1.9.0-15.el8_2.13 < * cpe:/a:redhat:rhel_aus:8.2::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:1.11.0-8.el8_4.12 < * cpe:/a:redhat:rhel_tus:8.4::appstream cpe:/a:redhat:rhel_e4s:8.4::appstream cpe:/a:redhat:rhel_aus:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Telecommunications Update Service	Unaffected: 0:1.11.0-8.el8_4.12 < * cpe:/a:redhat:rhel_tus:8.4::appstream cpe:/a:redhat:rhel_e4s:8.4::appstream cpe:/a:redhat:rhel_aus:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions	Unaffected: 0:1.11.0-8.el8_4.12 < * cpe:/a:redhat:rhel_tus:8.4::appstream cpe:/a:redhat:rhel_e4s:8.4::appstream cpe:/a:redhat:rhel_aus:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:1.12.0-6.el8_6.13 < * cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/a:redhat:rhel_aus:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	Unaffected: 0:1.12.0-6.el8_6.13 < * cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/a:redhat:rhel_aus:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	Unaffected: 0:1.12.0-6.el8_6.13 < * cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/a:redhat:rhel_aus:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	Unaffected: 0:1.12.0-15.el8_8.12 < * cpe:/a:redhat:rhel_eus:8.8::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:1.14.1-1.el9_5.1 < * cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	Unaffected: 0:1.11.0-22.el9_0.13 < * cpe:/a:redhat:rhel_e4s:9.0::appstream
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	Unaffected: 0:1.12.0-14.el9_2.10 < * cpe:/a:redhat:rhel_eus:9.2::appstream
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 0:1.13.1-8.el9_4.5 < * cpe:/a:redhat:rhel_eus:9.4::appstream
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2025-26598",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-25T16:24:04.385893Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-25T16:24:43.094Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               collectionURL: "https://gitlab.freedesktop.org/xorg/xserver/",
               defaultStatus: "unaffected",
               packageName: "xserver",
               versions: [
                  {
                     lessThan: "21.1.16",
                     status: "affected",
                     version: "0",
                     versionType: "semver",
                  },
                  {
                     lessThan: "24.1.6",
                     status: "affected",
                     version: "22.0.0",
                     versionType: "semver",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:rhel_els:7",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.8.0-36.el7_9",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:rhel_els:7",
               ],
               defaultStatus: "affected",
               packageName: "xorg-x11-server",
               product: "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.20.4-30.el7_9",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:enterprise_linux:8::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.13.1-15.el8_10",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_aus:8.2::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.2 Advanced Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.9.0-15.el8_2.13",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_tus:8.4::appstream",
                  "cpe:/a:redhat:rhel_e4s:8.4::appstream",
                  "cpe:/a:redhat:rhel_aus:8.4::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.11.0-8.el8_4.12",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_tus:8.4::appstream",
                  "cpe:/a:redhat:rhel_e4s:8.4::appstream",
                  "cpe:/a:redhat:rhel_aus:8.4::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.4 Telecommunications Update Service",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.11.0-8.el8_4.12",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_tus:8.4::appstream",
                  "cpe:/a:redhat:rhel_e4s:8.4::appstream",
                  "cpe:/a:redhat:rhel_aus:8.4::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.11.0-8.el8_4.12",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_e4s:8.6::appstream",
                  "cpe:/a:redhat:rhel_tus:8.6::appstream",
                  "cpe:/a:redhat:rhel_aus:8.6::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.12.0-6.el8_6.13",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_e4s:8.6::appstream",
                  "cpe:/a:redhat:rhel_tus:8.6::appstream",
                  "cpe:/a:redhat:rhel_aus:8.6::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.12.0-6.el8_6.13",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_e4s:8.6::appstream",
                  "cpe:/a:redhat:rhel_tus:8.6::appstream",
                  "cpe:/a:redhat:rhel_aus:8.6::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.12.0-6.el8_6.13",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_eus:8.8::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 8.8 Extended Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.12.0-15.el8_8.12",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:enterprise_linux:9::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 9",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.14.1-1.el9_5.1",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_e4s:9.0::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.11.0-22.el9_0.13",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_eus:9.2::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 9.2 Extended Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.12.0-14.el9_2.10",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_eus:9.4::appstream",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 9.4 Extended Update Support",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.13.1-8.el9_4.5",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:6",
               ],
               defaultStatus: "affected",
               packageName: "tigervnc",
               product: "Red Hat Enterprise Linux 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:6",
               ],
               defaultStatus: "unknown",
               packageName: "xorg-x11-server",
               product: "Red Hat Enterprise Linux 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:8",
               ],
               defaultStatus: "unaffected",
               packageName: "xorg-x11-server",
               product: "Red Hat Enterprise Linux 8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:8",
               ],
               defaultStatus: "unaffected",
               packageName: "xorg-x11-server-Xwayland",
               product: "Red Hat Enterprise Linux 8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:9",
               ],
               defaultStatus: "affected",
               packageName: "xorg-x11-server",
               product: "Red Hat Enterprise Linux 9",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:9",
               ],
               defaultStatus: "affected",
               packageName: "xorg-x11-server-Xwayland",
               product: "Red Hat Enterprise Linux 9",
               vendor: "Red Hat",
            },
         ],
         datePublic: "2025-02-25T00:00:00.000Z",
         descriptions: [
            {
               lang: "en",
               value: "An out-of-bounds write flaw was found in X.Org and Xwayland. The function GetBarrierDevice() searches for the pointer device based on its device ID and returns the matching value, or supposedly NULL, if no match was found. However, the code will return the last element of the list if no matching device ID is found, which can lead to out-of-bounds memory access.",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     namespace: "https://access.redhat.com/security/updates/classification/",
                     value: "Important",
                  },
                  type: "Red Hat severity rating",
               },
            },
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-787",
                     description: "Out-of-bounds Write",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-03-27T04:20:45.713Z",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "RHSA-2025:2500",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2500",
            },
            {
               name: "RHSA-2025:2502",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2502",
            },
            {
               name: "RHSA-2025:2861",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2861",
            },
            {
               name: "RHSA-2025:2862",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2862",
            },
            {
               name: "RHSA-2025:2865",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2865",
            },
            {
               name: "RHSA-2025:2866",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2866",
            },
            {
               name: "RHSA-2025:2873",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2873",
            },
            {
               name: "RHSA-2025:2874",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2874",
            },
            {
               name: "RHSA-2025:2875",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2875",
            },
            {
               name: "RHSA-2025:2879",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2879",
            },
            {
               name: "RHSA-2025:2880",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:2880",
            },
            {
               tags: [
                  "vdb-entry",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/security/cve/CVE-2025-26598",
            },
            {
               name: "RHBZ#2345254",
               tags: [
                  "issue-tracking",
                  "x_refsource_REDHAT",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2345254",
            },
         ],
         timeline: [
            {
               lang: "en",
               time: "2025-02-12T14:15:01.664000+00:00",
               value: "Reported to Red Hat.",
            },
            {
               lang: "en",
               time: "2025-02-25T00:00:00+00:00",
               value: "Made public.",
            },
         ],
         title: "Xorg: xwayland: out-of-bounds write in createpointerbarrierclient()",
         workarounds: [
            {
               lang: "en",
               value: "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
            },
         ],
         x_redhatCweChain: "CWE-787: Out-of-bounds Write",
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2025-26598",
      datePublished: "2025-02-25T15:54:57.355Z",
      dateReserved: "2025-02-12T14:12:22.796Z",
      dateUpdated: "2025-03-27T04:20:45.713Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

Vulnerability from csaf_suse

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature