CVE-2025-62230CWE-416

Xorg: xwayland: use-after-free in xkb client resource removal

High · published October 30, 2025

CVSS v3.1
7.3
EPSS
0%
Percentile
19.6
In the wild
Unconfirmed
What it is

⚡ A use-after-free condition in the X.Org X server could leave your system teetering on the edge! 🛑 Think of it like a restaurant that clears tables without properly removing all the dishes. When a new customer sits down, they might accidentally trip over leftover plates, causing a chaotic spill. This vulnerability can lead to memory corruption or even crash your system unexpectedly, creating a frustrating experience for users and potentially exposing sensitive data. An attacker might find ways to exploit this during client disconnections, leaving the door open for trouble.

Put simply

Think of it like a restaurant that clears tables without properly removing all the dishes. When a new customer sits down, they might accidentally trip over leftover plates, causing a chaotic spill. The flaw in the X Keyboard (Xkb) extension allows the software to free certain data structures without properly detaching related resources, resulting in a dangerous use-after-free state that can be exploited.

What to do

This vulnerability can lead to memory corruption or even crash your system unexpectedly, creating a frustrating experience for users and potentially exposing sensitive data. An attacker might find ways to exploit this during client disconnections, leaving the door open for trouble. Make sure to update your X.Org X server to the latest version where this issue has been addressed. Regularly audit your configurations and ensure that your server is running a supported version to mitigate risks. You've got this! With a simple update, you'll keep your systems safe and sound. 🛡️

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00282 · 19.6th percentile
Weakness
CWE-416 · Use After Free
Published
2025-10-30T05:19Z
EPSS history
Timeline
  • 30 OCT 05:19Z
    Xorg: xwayland: use-after-free in xkb client resource removal
    cvelistv5