// For flags

CVE-2025-26600

Xorg: xwayland: use-after-free in playreleasedevents()

Severity Score

7.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

A use-after-free flaw was found in X.Org and Xwayland. When a device is removed while still frozen, the events queued for that device remain while the device is freed. Replaying the events will cause a use-after-free.

This vulnerability allows local attackers to escalate privileges on affected installations of X.Org Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the handling of device objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root.

This update for xorg-x11-server fixes the following issues. Use-after-free of the root cursor. Buffer overflow in XkbVModMaskText. Heap overflow in XkbWriteKeySyms. Buffer overflow in XkbChangeTypesOfKey. Out-of-bounds write in CreatePointerBarrierClient. Use of uninitialized pointer in compRedirectWindow. Use-after-free in PlayReleasedEvents. Use-after-free in SyncInitTrigger.

*Credits: Jan-Niklas Sohn
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Local
Attack Complexity
Low
Authentication
Single
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
None
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2025-02-12 CVE Reserved
  • 2025-02-25 CVE Published
  • 2025-06-16 CVE Updated
  • 2025-06-27 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-416: Use After Free
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Oracle
Search vendor "Oracle"
Linux
Search vendor "Oracle" for product "Linux"
*-
Affected
Red Hat
Search vendor "Red Hat"
Enterprise Linux
Search vendor "Red Hat" for product "Enterprise Linux"
*-
Affected
Redhat
Search vendor "Redhat"
Enterprise Linux
Search vendor "Redhat" for product "Enterprise Linux"
*-
Affected
Redhat
Search vendor "Redhat"
Rhel Aus
Search vendor "Redhat" for product "Rhel Aus"
*-
Affected
Redhat
Search vendor "Redhat"
Rhel E4s
Search vendor "Redhat" for product "Rhel E4s"
*-
Affected
Redhat
Search vendor "Redhat"
Rhel Eus
Search vendor "Redhat" for product "Rhel Eus"
*-
Affected
Redhat
Search vendor "Redhat"
Rhel Tus
Search vendor "Redhat" for product "Rhel Tus"
*-
Affected
Tigervnc
Search vendor "Tigervnc"
Tigervnc
Search vendor "Tigervnc" for product "Tigervnc"
*-
Affected
X.org
Search vendor "X.org"
X Server
Search vendor "X.org" for product "X Server"
*-
Affected
X.org
Search vendor "X.org"
Xwayland
Search vendor "X.org" for product "Xwayland"
*-
Affected
Amazon
Search vendor "Amazon"
Linux
Search vendor "Amazon" for product "Linux"
*-
Affected
Canonical
Search vendor "Canonical"
Ubuntu Linux
Search vendor "Canonical" for product "Ubuntu Linux"
*-
Affected
Debian
Search vendor "Debian"
Debian Linux
Search vendor "Debian" for product "Debian Linux"
*-
Affected
Fedoraproject
Search vendor "Fedoraproject"
Fedora
Search vendor "Fedoraproject" for product "Fedora"
*-
Affected
Freebsd
Search vendor "Freebsd"
Freebsd
Search vendor "Freebsd" for product "Freebsd"
*-
Affected
Opensuse
Search vendor "Opensuse"
Leap
Search vendor "Opensuse" for product "Leap"
*-
Affected
Oracle
Search vendor "Oracle"
Linux
Search vendor "Oracle" for product "Linux"
*-
Affected
Redhat
Search vendor "Redhat"
Enterprise Linux
Search vendor "Redhat" for product "Enterprise Linux"
*-
Affected
Redhat
Search vendor "Redhat"
Rhel Aus
Search vendor "Redhat" for product "Rhel Aus"
*-
Affected
Redhat
Search vendor "Redhat"
Rhel E4s
Search vendor "Redhat" for product "Rhel E4s"
*-
Affected
Redhat
Search vendor "Redhat"
Rhel Els
Search vendor "Redhat" for product "Rhel Els"
*-
Affected
Redhat
Search vendor "Redhat"
Rhel Eus
Search vendor "Redhat" for product "Rhel Eus"
*-
Affected
Redhat
Search vendor "Redhat"
Rhel Tus
Search vendor "Redhat" for product "Rhel Tus"
*-
Affected
Rocky
Search vendor "Rocky"
Linux
Search vendor "Rocky" for product "Linux"
*-
Affected
Slackware
Search vendor "Slackware"
Slackware Linux
Search vendor "Slackware" for product "Slackware Linux"
*-
Affected
Suse
Search vendor "Suse"
Sle-module-basesystem
Search vendor "Suse" for product "Sle-module-basesystem"
*-
Affected
Suse
Search vendor "Suse"
Sle-module-development-tools
Search vendor "Suse" for product "Sle-module-development-tools"
*-
Affected
Suse
Search vendor "Suse"
Sle-we
Search vendor "Suse" for product "Sle-we"
*-
Affected
Suse
Search vendor "Suse"
Sle Hpc-espos
Search vendor "Suse" for product "Sle Hpc-espos"
*-
Affected
Suse
Search vendor "Suse"
Sle Hpc-ltss
Search vendor "Suse" for product "Sle Hpc-ltss"
*-
Affected
Suse
Search vendor "Suse"
Sles-ltss-extended-security
Search vendor "Suse" for product "Sles-ltss-extended-security"
*-
Affected
Suse
Search vendor "Suse"
Sles-ltss
Search vendor "Suse" for product "Sles-ltss"
*-
Affected
Suse
Search vendor "Suse"
Sles Sap
Search vendor "Suse" for product "Sles Sap"
*-
Affected
Suse
Search vendor "Suse"
Suse-manager-proxy
Search vendor "Suse" for product "Suse-manager-proxy"
*-
Affected
Suse
Search vendor "Suse"
Suse-manager-server
Search vendor "Suse" for product "Suse-manager-server"
*-
Affected