CVE-2025-26598: Xorg: xwayland: out-of-bounds write in createpointerbarrierclient()
An out-of-bounds write flaw was found in X.Org and Xwayland. The function GetBarrierDevice() searches for the pointer device based on its device ID and returns the matching value, or supposedly NULL, if no match was found. However, the code will return the last element of the list if no matching device ID is found, which can lead to out-of-bounds memory access.
Other sources
The function GetBarrierDevice() searches for the pointer device based on its device id and returns the matching value, or supposedly NULL if no match was found.
However the code will return the last element of the list if no matching device id was found which can lead to out of bounds memory access.
— Red Hat
Xorg: xwayland: out-of-bounds write in createpointerbarrierclient()
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/xorg-serverto a version that resolves this vulnerability.Fixed in 2:1.20.11-1+deb11u15Fixed in 2:21.1.7-3+deb12u9Fixed in 2:21.1.16-1 - Upgrade
Upgrade
debian/xwaylandto a version that resolves this vulnerability.Fixed in 2:24.1.6-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.20.10-15 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.1.6-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-26598?
CVE-2025-26598 has been classified as a high-severity vulnerability due to its potential for causing out-of-bounds write errors.
How do I fix CVE-2025-26598?
To fix CVE-2025-26598, update the xorg-server and xwayland packages to the latest secure versions provided by your distribution.
Which software is affected by CVE-2025-26598?
CVE-2025-26598 affects the xorg-server and xwayland packages in specific versions as noted by the vulnerability report.
What could happen if CVE-2025-26598 is exploited?
Exploitation of CVE-2025-26598 could lead to potential system crashes or unauthorized access due to memory corruption.
Is there a known exploit for CVE-2025-26598?
As of now, there are no publicly disclosed exploits for CVE-2025-26598, but it remains a significant security concern.