CVE-2025-26599CWE-824

Xorg: xwayland: use of uninitialized pointer in compredirectwindow()

High · published February 25, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
33.6
In the wild
Unconfirmed
What it is

An access to an uninitialized pointer flaw was found in X.Org and Xwayland. The function compCheckRedirect() may fail if it cannot allocate the backing pixmap. In that case, compRedirectWindow() will return a BadAlloc error without validating the window tree marked just before, which leaves the validated data partly initialized and the use of an uninitialized pointer later.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00405 · 33.6th percentile
Weakness
CWE-824 · Access of Uninitialized Pointer
Published
2025-02-25T15:55Z
EPSS history
Timeline
  • 25 FEB 15:55Z
    Xorg: xwayland: use of uninitialized pointer in compredirectwindow()
    cvelistv5