VYPR
Get started
← All advisories
High severity7.8NVD Advisory· Published Feb 25, 2025· Updated Apr 6, 2026

CVE-2025-26594

CVE-2025-26594

Description

A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a global variable. If a client frees the root cursor, the internal reference points to freed memory and causes a use-after-free.

Affected products

6
  • Tigervnc/Tigervnc
    cpe:2.3:a:tigervnc:tigervnc:-:*:*:*:*:*:*:*
  • Xorg/Xserver
    cpe:2.3:a:x.org:x_server:*:*:*:*:*:*:*:*
    Range: <21.1.16
  • Xorg/Xwayland
    cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:*
    Range: <24.1.6
  • Red Hat/Enterprise Linux3 versions
    cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

18

News mentions

0

No linked articles in our index yet.