Multiple vulnerabilities in X.Org X server and Xwayland



| Updated: 2025-03-14
Risk Low
Patch available YES
Number of vulnerabilities 8
CVE-ID CVE-2025-26594
CVE-2025-26595
CVE-2025-26596
CVE-2025-26597
CVE-2025-26598
CVE-2025-26599
CVE-2025-26600
CVE-2025-26601
CWE-ID CWE-416
CWE-119
CWE-122
CWE-787
CWE-824
Exploitation vector Local
Public exploit N/A
Vulnerable software
 X.org Server
Server applications / Other server solutions

Xwayland
Client/Desktop applications / Multimedia software

Vendor X.org

Security Bulletin

This security bulletin contains information about 8 vulnerabilities.

1) Use-after-free

EUVDB-ID: #VU104190

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-26594

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error of the root cursor. A local user can execute arbitrary code with elevated privileges.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

X.org Server: 21.0.99.1 - 21.1.15

Xwayland: 21.0.99.901 - 24.1.5

CPE2.3 External links

https://bugzilla.redhat.com/show_bug.cgi?id=2345248
https://gitlab.freedesktop.org/xorg/xserver/-/commit/01642f26
https://gitlab.freedesktop.org/xorg/xserver/-/commit/b0a09ba6
https://www.zerodayinitiative.com/advisories/ZDI-25-143/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Buffer overflow

EUVDB-ID: #VU104191

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-26595

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the XkbVModMaskText() function. A local user can trigger memory corruption and execute arbitrary code with elevated privileges.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

X.org Server: 21.0.99.1 - 21.1.15

Xwayland: 21.0.99.901 - 24.1.5

CPE2.3 External links

https://bugzilla.redhat.com/show_bug.cgi?id=2345257
https://gitlab.freedesktop.org/xorg/xserver/-/commit/11fcda8
https://www.zerodayinitiative.com/advisories/ZDI-25-142/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Heap-based buffer overflow

EUVDB-ID: #VU104192

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-26596

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the XkbWriteKeySyms() function. A local user can  trigger a heap-based buffer overflow and execute arbitrary code with elevated privileges.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

X.org Server: 21.0.99.1 - 21.1.15

Xwayland: 21.0.99.901 - 24.1.5

CPE2.3 External links

https://bugzilla.redhat.com/show_bug.cgi?id=2345256
https://gitlab.freedesktop.org/xorg/xserver/-/commit/80d69f01
https://www.zerodayinitiative.com/advisories/ZDI-25-141/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Buffer overflow

EUVDB-ID: #VU104193

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-26597

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the XkbChangeTypesOfKey() function. A local user can trigger memory corruption and execute arbitrary code with elevated privileges.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

X.org Server: 21.0.99.1 - 21.1.15

Xwayland: 21.0.99.901 - 24.1.5

CPE2.3 External links

https://bugzilla.redhat.com/show_bug.cgi?id=2345255
https://gitlab.freedesktop.org/xorg/xserver/-/commit/0e4ed949
https://www.zerodayinitiative.com/advisories/ZDI-25-140/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Out-of-bounds write

EUVDB-ID: #VU104194

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-26598

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the CreatePointerBarrierClient() function. A local user can trigger an out-of-bounds write and execute arbitrary code with elevated privileges.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

X.org Server: 21.0.99.1 - 21.1.15

Xwayland: 21.0.99.901 - 24.1.5

CPE2.3 External links

https://bugzilla.redhat.com/show_bug.cgi?id=2345254
https://gitlab.freedesktop.org/xorg/xserver/-/commit/bba9df1a
https://www.zerodayinitiative.com/advisories/ZDI-25-139/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Access of uninitialized pointer

EUVDB-ID: #VU104195

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-26599

CWE-ID: CWE-824 - Access of Uninitialized Pointer

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to usage of an uninitialized pointer within the compRedirectWindow() function. A local user can execute arbitrary code with elevated privileges.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

X.org Server: 21.0.99.1 - 21.1.15

Xwayland: 21.0.99.901 - 24.1.5

CPE2.3 External links

https://bugzilla.redhat.com/show_bug.cgi?id=2345253
https://gitlab.freedesktop.org/xorg/xserver/-/commit/c1ff84be
https://gitlab.freedesktop.org/xorg/xserver/-/commit/b07192a8
https://www.zerodayinitiative.com/advisories/ZDI-25-138/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Use-after-free

EUVDB-ID: #VU104196

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-26600

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the PlayReleasedEvents() function. A local user can execute arbitrary code with elevated privileges.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

X.org Server: 21.0.99.1 - 21.1.15

Xwayland: 21.0.99.901 - 24.1.5

CPE2.3 External links

https://bugzilla.redhat.com/show_bug.cgi?id=2345252
https://gitlab.freedesktop.org/xorg/xserver/-/commit/6e0f332b
https://www.zerodayinitiative.com/advisories/ZDI-25-137/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Use-after-free

EUVDB-ID: #VU104197

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-26601

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the SyncInitTrigger() function. A local user can execute arbitrary code with elevated privileges.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

X.org Server: 21.0.99.1 - 21.1.15

Xwayland: 21.0.99.901 - 24.1.5

CPE2.3 External links

https://bugzilla.redhat.com/show_bug.cgi?id=2345251
https://gitlab.freedesktop.org/xorg/xserver/-/commit/16a1242d
https://gitlab.freedesktop.org/xorg/xserver/-/commit/f52cea2f
https://gitlab.freedesktop.org/xorg/xserver/-/commit/8cbc90c8
https://gitlab.freedesktop.org/xorg/xserver/-/commit/c2857989
https://www.zerodayinitiative.com/advisories/ZDI-25-136/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###