CVE-2025-26597: Xorg: xwayland: buffer overflow in xkbchangetypesofkey()
A buffer overflow flaw was found in X.Org and Xwayland. If XkbChangeTypesOfKey() is called with a 0 group, it will resize the key symbols table to 0 but leave the key actions unchanged. If the same function is later called with a non-zero value of groups, this will cause a buffer overflow because the key actions are of the wrong size.
Other sources
If XkbChangeTypesOfKey() is called with 0 group, it will resize the key symbols table to 0 but leave the key actions unchanged.
If later, the same function is called with a non-zero value of groups, this will cause a buffer overflow because the key actions are of the wrong size.
— Red Hat
Xorg: xwayland: buffer overflow in xkbchangetypesofkey()
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/xorg-serverto a version that resolves this vulnerability.Fixed in 2:1.20.11-1+deb11u15Fixed in 2:21.1.7-3+deb12u9Fixed in 2:21.1.16-1 - Upgrade
Upgrade
debian/xwaylandto a version that resolves this vulnerability.Fixed in 2:24.1.6-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.1.6-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.20.10-15
Event History
Frequently Asked Questions
What is the severity of CVE-2025-26597?
CVE-2025-26597 is classified as a medium-severity vulnerability due to its potential to cause a buffer overflow.
How do I fix CVE-2025-26597?
To mitigate CVE-2025-26597, update the affected xorg-server and xwayland packages to their latest versions as specified in the vulnerability description.
Which software is affected by CVE-2025-26597?
CVE-2025-26597 affects xorg-server versions up to 2:21.1.15-3 and xwayland versions up to 2:24.1.5-1.
What type of vulnerability is CVE-2025-26597?
CVE-2025-26597 is a buffer overflow vulnerability that occurs due to improper handling of the key symbols table in X.Org and Xwayland.
Can CVE-2025-26597 be exploited remotely?
Exploitation of CVE-2025-26597 may allow an attacker to execute arbitrary code, which could potentially be done remotely depending on the deployment scenario.