CVE-2025-26594CWE-416

X.org: xwayland: use-after-free of the root cursor

High · published February 25, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
32.4
In the wild
Unconfirmed
What it is

A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a global variable. If a client frees the root cursor, the internal reference points to freed memory and causes a use-after-free.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00393 · 32.4th percentile
Weakness
CWE-416 · Use After Free
Published
2025-02-25T15:53Z
EPSS history
Timeline
  • 25 FEB 15:53Z
    X.org: xwayland: use-after-free of the root cursor
    cvelistv5