CVE-2025-26594: X.org: xwayland: use-after-free of the root cursor
A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a global variable. If a client frees the root cursor, the internal reference points to freed memory and causes a use-after-free.
Other sources
The root cursor is referenced in the xserver as a global variable. If a client manages to free the root cursor, the internal reference points to freed memory and causes a use-after-free.
— Red Hat
X.org: xwayland: use-after-free of the root cursor
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/xorg-serverto a version that resolves this vulnerability.Fixed in 2:1.20.11-1+deb11u15Fixed in 2:21.1.7-3+deb12u9Fixed in 2:21.1.16-1 - Upgrade
Upgrade
debian/xwaylandto a version that resolves this vulnerability.Fixed in 2:24.1.6-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.20.10-15 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.1.6-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-26594?
CVE-2025-26594 has been classified as a moderate severity use-after-free vulnerability.
How do I fix CVE-2025-26594?
To remediate CVE-2025-26594, update the xorg-server and xwayland packages to their latest versions as specified by your distribution.
Which versions of xorg-server are affected by CVE-2025-26594?
The affected versions of xorg-server include 2:1.20.11-1+deb11u13, 2:1.20.11-1+deb11u14, 2:21.1.7-3+deb12u8, and 2:21.1.15-3.
Which versions of xwayland are affected by CVE-2025-26594?
The affected versions of xwayland are 2:22.1.9-1 and 2:24.1.5-1.
What component does CVE-2025-26594 impact?
CVE-2025-26594 impacts the X.Org and Xwayland components, specifically involving a use-after-free issue with the root cursor.