VYPR
Get started
← All advisories
High severity7.8NVD Advisory· Published Feb 25, 2025· Updated Apr 6, 2026

CVE-2025-26599

CVE-2025-26599

Description

An access to an uninitialized pointer flaw was found in X.Org and Xwayland. The function compCheckRedirect() may fail if it cannot allocate the backing pixmap. In that case, compRedirectWindow() will return a BadAlloc error without validating the window tree marked just before, which leaves the validated data partly initialized and the use of an uninitialized pointer later.

Affected products

6
  • Tigervnc/Tigervnc
    cpe:2.3:a:tigervnc:tigervnc:-:*:*:*:*:*:*:*
  • Xorg/Xserver
    cpe:2.3:a:x.org:x_server:*:*:*:*:*:*:*:*
    Range: <21.1.16
  • Xorg/Xwayland
    cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:*
    Range: <24.1.6
  • Red Hat/Enterprise Linux3 versions
    cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

18

News mentions

0

No linked articles in our index yet.