high7.8
CVE-2025-26600
A use-after-free flaw was found in X.Org and Xwayland.
Impact
A use-after-free flaw was found in X.Org and Xwayland. When a device is removed while still frozen, the events queued for that device remain while the device is freed. Replaying the events will cause a use-after-free.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Tigervnc | Tigervnc | All versions |
| X.Org | X Server | before 21.1.16 |
| X.Org | Xwayland | before 24.1.6 |
| Redhat | Enterprise Linux | Versions 7.0, 8.0, 9.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://access.redhat.com/errata/RHSA-2025:2500
- https://access.redhat.com/errata/RHSA-2025:2502
- https://access.redhat.com/errata/RHSA-2025:2861
- https://access.redhat.com/errata/RHSA-2025:2862
- https://access.redhat.com/errata/RHSA-2025:2865
- https://access.redhat.com/errata/RHSA-2025:2866
- https://access.redhat.com/errata/RHSA-2025:2873
- https://access.redhat.com/errata/RHSA-2025:2874
- https://access.redhat.com/errata/RHSA-2025:2875
- https://access.redhat.com/errata/RHSA-2025:2879
- https://access.redhat.com/errata/RHSA-2025:2880
- https://access.redhat.com/errata/RHSA-2025:3976
- https://access.redhat.com/errata/RHSA-2025:7163
- https://access.redhat.com/errata/RHSA-2025:7165
- https://access.redhat.com/errata/RHSA-2025:7458
- https://access.redhat.com/security/cve/CVE-2025-26600
- https://bugzilla.redhat.com/show_bug.cgi?id=2345252
- https://lists.debian.org/debian-lts-announce/2025/02/msg00036.html
- https://security.netapp.com/advisory/ntap-20250516-0005/