A use‑after‑free flaw was discovered in the X.Org X server and its XWayland compatibility layer. The root cursor is kept in a global variable; if a client frees that cursor, the X server later dereferences freed memory, leading to memory corruption at the server level. This can result in a crash of the X session or, in a more severe case, allow execution of attacker‑supplied code from the context of the X server process. The vulnerability is classified as CWE‑416 and has a CVSS score of 7.8 indicating high severity.

Red Hat Enterprise Linux 6, 7, 8, 9 and the forthcoming RHEL 10 are all affected, including all extended update and advanced support lines such as RHEL AUS, E4S, EUS, and TUS. The flaw is also present in the upstream X.org X server, XWayland components, and TigerVNC packages that rely on these libraries; any installation that uses the default X server or XWayland packages is vulnerable as listed in the linked errata.

The CVSS base score of 7.8 marks the flaw as high risk, while the EPSS score of less than 1 % indicates a currently low exploitation likelihood. It is not listed in the CISA KEV catalogue, suggesting that widespread exploitation has not been observed yet. Nonetheless, because the flaw involves a global resource in the X server, a malicious local client that freely the root cursor could trigger the use‑after‑free, potentially crashing the graphical session or enabling local code execution. The attack requires local access to the X server and is therefore limited to environments where an attacker can run an arbitrary client. Prompt application of the Red Hat errata is the recommended mitigation.