CVE-2025-62229CWE-416

Xorg: xmayland: use-after-free in xpresentnotify structure creation

High · published October 30, 2025

CVSS v3.1
7.3
EPSS
1%
Percentile
42.5
In the wild
Unconfirmed
What it is

⚡ A crafty error in the X.Org X server is leaving the door wide open for chaos! This flaw can lead to memory corruption like a foggy windshield during a rainy drive — you just can't see the road ahead! Picture this: You’re at a restaurant, and the waiter accidentally leaves your order on the counter. When the next customer picks it up, they might get a surprise dish that doesn’t belong to them. This flaw in the X server allows for a use-after-free condition where erroneous notifications can cause unexpected code execution or crashes, like someone mistakenly grabbing the wrong meal! An attacker could exploit this vulnerability to execute arbitrary code on the system, potentially leading to a full compromise. Even worse, it could trigger crashes resulting in a denial of service, leaving users locked out and frustrated. This is not just a minor hiccup; it's a recipe for disaster!

Put simply

Picture this: You’re at a restaurant, and the waiter accidentally leaves your order on the counter. When the next customer picks it up, they might get a surprise dish that doesn’t belong to them. This flaw in the X server allows for a use-after-free condition where erroneous notifications can cause unexpected code execution or crashes, like someone mistakenly grabbing the wrong meal! This vulnerability arises from improper error handling during the creation of X11 Present extension notifications. Specifically, it leaves dangling pointers that can cause a use-after-free condition, allowing for memory corruption and arbitrary code execution.

What to do

An attacker could exploit this vulnerability to execute arbitrary code on the system, potentially leading to a full compromise. Even worse, it could trigger crashes resulting in a denial of service, leaving users locked out and frustrated. This is not just a minor hiccup; it's a recipe for disaster! To secure your systems, update the X.Org X server and Xwayland to the latest patched versions as soon as they are available. Regularly audit your systems and ensure proper error handling is in place to prevent similar vulnerabilities in the future. 🛡️ You’ve got this! Stay vigilant, follow these steps, and you’ll keep your systems safe and sound! 🚀

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00508 · 42.5th percentile
Weakness
CWE-416 · Use After Free
Published
2025-10-30T05:28Z
EPSS history
Timeline
  • 30 OCT 05:28Z
    Xorg: xmayland: use-after-free in xpresentnotify structure creation
    cvelistv5