Untriaged
Permalink
CVE-2025-26594
7.8 HIGH
- CVSS version: 3.1
- Attack vector (AV): LOCAL
- Attack complexity (AC): LOW
- Privileges required (PR): LOW
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): HIGH
- Integrity impact (I): HIGH
- Availability impact (A): HIGH
X.org: xwayland: use-after-free of the root cursor
A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a global variable. If a client frees the root cursor, the internal reference points to freed memory and causes a use-after-free.
References
- https://access.redhat.com/security/cve/CVE-2025-26594 x_refsource_REDHAT vdb-entry
- RHBZ#2345248 issue-tracking x_refsource_REDHAT
- RHBZ#2345248 issue-tracking x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2025-26594 x_refsource_REDHAT vdb-entry
- RHSA-2025:2500 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2502 x_refsource_REDHAT vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-26594 x_refsource_REDHAT vdb-entry
- RHBZ#2345248 issue-tracking x_refsource_REDHAT
- RHSA-2025:2500 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2502 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2861 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2862 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2865 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2866 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2873 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2874 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2875 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2879 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2880 x_refsource_REDHAT vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-26594 x_refsource_REDHAT vdb-entry
- RHBZ#2345248 issue-tracking x_refsource_REDHAT
- RHSA-2025:2879 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2880 x_refsource_REDHAT vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-26594 x_refsource_REDHAT vdb-entry
- RHBZ#2345248 issue-tracking x_refsource_REDHAT
- RHSA-2025:2500 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2502 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2861 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2862 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2865 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2866 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2873 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2874 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2875 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2500 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2502 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2861 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2862 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2865 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2866 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2873 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2874 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2875 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2879 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2880 x_refsource_REDHAT vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-26594 x_refsource_REDHAT vdb-entry
- RHBZ#2345248 issue-tracking x_refsource_REDHAT
- RHSA-2025:2500 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2502 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2861 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2862 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2865 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2866 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2873 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2874 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2875 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2879 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2880 x_refsource_REDHAT vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-26594 x_refsource_REDHAT vdb-entry
- RHBZ#2345248 issue-tracking x_refsource_REDHAT
- RHSA-2025:2500 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2502 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2861 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2862 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2865 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2866 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2873 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2874 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2875 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2879 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2880 x_refsource_REDHAT vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-26594 x_refsource_REDHAT vdb-entry
- RHBZ#2345248 issue-tracking x_refsource_REDHAT
- RHSA-2025:2879 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2880 x_refsource_REDHAT vendor-advisory
- RHSA-2025:7163 x_refsource_REDHAT vendor-advisory
- RHSA-2025:7165 x_refsource_REDHAT vendor-advisory
- RHSA-2025:7458 x_refsource_REDHAT vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-26594 x_refsource_REDHAT vdb-entry
- RHBZ#2345248 issue-tracking x_refsource_REDHAT
- RHSA-2025:2500 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2502 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2861 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2862 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2865 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2866 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2873 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2874 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2875 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2500 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2502 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2861 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2862 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2865 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2866 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2873 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2874 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2875 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2879 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2880 x_refsource_REDHAT vendor-advisory
- RHSA-2025:7163 x_refsource_REDHAT vendor-advisory
- RHSA-2025:7165 x_refsource_REDHAT vendor-advisory
- RHSA-2025:7458 x_refsource_REDHAT vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-26594 x_refsource_REDHAT vdb-entry
- RHBZ#2345248 issue-tracking x_refsource_REDHAT
- RHSA-2025:2500 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2502 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2861 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2862 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2865 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2866 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2873 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2874 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2875 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2879 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2880 x_refsource_REDHAT vendor-advisory
- RHSA-2025:7163 x_refsource_REDHAT vendor-advisory
- RHSA-2025:7165 x_refsource_REDHAT vendor-advisory
- RHSA-2025:7458 x_refsource_REDHAT vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-26594 x_refsource_REDHAT vdb-entry
- RHBZ#2345248 issue-tracking x_refsource_REDHAT
- RHSA-2025:2500 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2502 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2861 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2862 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2865 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2866 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2873 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2874 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2875 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2879 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2880 x_refsource_REDHAT vendor-advisory
- RHSA-2025:7163 x_refsource_REDHAT vendor-advisory
- RHSA-2025:7165 x_refsource_REDHAT vendor-advisory
- RHSA-2025:7458 x_refsource_REDHAT vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-26594 x_refsource_REDHAT vdb-entry
- RHBZ#2345248 issue-tracking x_refsource_REDHAT
- https://lists.debian.org/debian-lts-announce/2025/02/msg00036.html
- RHSA-2025:2500 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2502 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2861 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2862 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2865 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2866 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2873 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2874 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2875 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2879 x_refsource_REDHAT vendor-advisory
- RHSA-2025:2880 x_refsource_REDHAT vendor-advisory
- RHSA-2025:7163 x_refsource_REDHAT vendor-advisory
- RHSA-2025:7165 x_refsource_REDHAT vendor-advisory
- RHSA-2025:7458 x_refsource_REDHAT vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-26594 x_refsource_REDHAT vdb-entry
- RHBZ#2345248 issue-tracking x_refsource_REDHAT
- https://lists.debian.org/debian-lts-announce/2025/02/msg00036.html
Affected products
xserver
- <21.1.16
- <24.1.6
tigervnc
- *
xorg-x11-server
- *
xorg-x11-server-Xwayland
- *