High severity · published Feb 25, 2025
CVE-2025-26599
An access to an uninitialized pointer flaw was found in X.Org and Xwayland
7.8
CVSS
0.4%
EPSS
No
On KEV
Description
An access to an uninitialized pointer flaw was found in X.Org and Xwayland. The function compCheckRedirect() may fail if it cannot allocate the backing pixmap. In that case, compRedirectWindow() will return a BadAlloc error without validating the window tree marked just before, which leaves the validated data partly initialized and the use of an uninitialized pointer later.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
Enterprise Linux · Redhat
7.0; 8.0; 9.0 · source: NVD
TI
Tigervnc · Tigervnc
All versions, or not specified · source: NVD
XS
X Server · X.org
before 21.1.16 · source: NVD
XW
Xwayland · X.org
before 24.1.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-26599
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-26599
Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:2500
Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:2502
Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:2861
Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:2862
Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:2865
Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:2866
More from Enterprise Linux
9.8
CVE-2019-11043
Underflow in PHP-FPM can lead to RCE
9.8
CVE-2018-14667
The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource
9.8
CVE-2014-7169
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
9.8
CVE-2014-6271
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
9.0
CVE-2021-40438
mod_proxy SSRF