Description
A use-after-free flaw was found in X.Org and Xwayland. When a device is removed while still frozen, the events queued for that device remain while the device is freed. Replaying the events will cause a use-after-free.
Published: 2025-02-25
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Local Privilege Escalation
Action: Patch Now
AI Analysis

Impact

A use‑after‑free flaw in the X.Org X Server and XWayland causes a freed memory reference when a device that is still frozen is removed. Replay of queued events can corrupt memory and may allow arbitrary code execution. The vulnerability is a classic unsafe memory deallocation error (CWE‑416).

Affected Systems

Red Hat Enterprise Linux 6, 7, 8, 9, and 10, including all extended, advanced, and specialized update streams, are affected. The flaw also impacts the X.Org X Server, XWayland, and Tiger VNC applications distributed by Red Hat.

Risk and Exploitability

The CVSS score of 7.8 indicates high severity, while the EPSS score of < 1 % suggests low current exploitation activity. The flaw appears to require a local or privileged context, such as the removal of a frozen device during a user session, rather than direct remote network input. It is not listed in the CISA KEV catalog. With no temporary workaround available, the only effective mitigations are vendor patches and maintaining up‑to‑date kernel and application releases.

Generated by OpenCVE AI on April 28, 2026 at 12:01 UTC.

Remediation

Vendor Workaround

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

OpenCVE Recommended Actions

  • Apply the Red Hat Security Advisory updates RHSA‑2025:2500, RHSA‑2025:2502, and RHSA‑2025:2861, along with any subsequent errata for your RHEL release, to update the X.Org and XWayland packages.
  • If TigerVNC or other XWayland‑based packages are installed, ensure those are upgraded to the latest patched versions included in the same errata releases.
  • Because no temporary workaround exists, consider retiring unsupported RHEL releases such as RHEL 6 or 7 and migrating to current supported versions to maintain overall platform security.

Generated by OpenCVE AI on April 28, 2026 at 12:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4072-1 xorg-server security update
Debian DSA Debian DSA DSA-5872-1 xorg-server security update
EUVD EUVD EUVD-2025-5425 A use-after-free flaw was found in X.Org and Xwayland. When a device is removed while still frozen, the events queued for that device remain while the device is freed. Replaying the events will cause a use-after-free.
Ubuntu USN Ubuntu USN USN-7299-1 X.Org X Server vulnerabilities
Ubuntu USN Ubuntu USN USN-7299-2 X.Org X Server vulnerabilities
Ubuntu USN Ubuntu USN USN-7299-4 X.Org X Server regression
History

Mon, 06 Apr 2026 13:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/o:redhat:rhel_els:6
References

Mon, 03 Nov 2025 22:30:00 +0000

Type Values Removed Values Added
References

Fri, 16 May 2025 23:45:00 +0000

Type Values Removed Values Added
References

Tue, 13 May 2025 20:15:00 +0000

Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:10.0
References

Tue, 13 May 2025 14:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:9 cpe:/a:redhat:enterprise_linux:9::crb
References

Thu, 08 May 2025 17:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:x.org:x_server:-:*:*:*:*:*:*:*
cpe:2.3:a:x.org:xwayland:-:*:*:*:*:*:*:*		 cpe:2.3:a:x.org:x_server:*:*:*:*:*:*:*:*
cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:*

Mon, 17 Mar 2025 15:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:rhel_aus:8.2
cpe:/a:redhat:rhel_aus:8.4
cpe:/a:redhat:rhel_aus:8.6
cpe:/a:redhat:rhel_e4s:8.4
cpe:/a:redhat:rhel_e4s:8.6
cpe:/a:redhat:rhel_e4s:9.0
cpe:/a:redhat:rhel_eus:8.8
cpe:/a:redhat:rhel_eus:9.2
cpe:/a:redhat:rhel_eus:9.4
cpe:/a:redhat:rhel_tus:8.4
cpe:/a:redhat:rhel_tus:8.6

Mon, 17 Mar 2025 05:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhel Els
CPEs cpe:/o:redhat:enterprise_linux:7 cpe:/a:redhat:rhel_aus:8.2::appstream
cpe:/a:redhat:rhel_aus:8.6::appstream
cpe:/a:redhat:rhel_e4s:8.6::appstream
cpe:/a:redhat:rhel_e4s:9.0::appstream
cpe:/a:redhat:rhel_tus:8.6::appstream
cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat rhel Els
References

Mon, 17 Mar 2025 02:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhel Aus
Redhat rhel E4s
Redhat rhel Tus
CPEs cpe:/a:redhat:rhel_aus:8.4::appstream
cpe:/a:redhat:rhel_e4s:8.4::appstream
cpe:/a:redhat:rhel_eus:9.2::appstream
cpe:/a:redhat:rhel_eus:9.4::appstream
cpe:/a:redhat:rhel_tus:8.4::appstream
Vendors & Products Redhat rhel Aus
Redhat rhel E4s
Redhat rhel Tus
References

Mon, 17 Mar 2025 01:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhel Eus
CPEs cpe:/a:redhat:rhel_eus:8.8::appstream
Vendors & Products Redhat rhel Eus
References

Tue, 11 Mar 2025 02:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:enterprise_linux:8
cpe:/a:redhat:enterprise_linux:9

Mon, 10 Mar 2025 13:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:enterprise_linux:8::appstream
cpe:/a:redhat:enterprise_linux:9::appstream
References

Tue, 04 Mar 2025 18:00:00 +0000

Type Values Removed Values Added
First Time appeared Tigervnc
Tigervnc tigervnc
X.org
X.org x Server
X.org xwayland
CPEs cpe:2.3:a:tigervnc:tigervnc:-:*:*:*:*:*:*:*
cpe:2.3:a:x.org:x_server:-:*:*:*:*:*:*:*
cpe:2.3:a:x.org:xwayland:-:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
Vendors & Products Tigervnc
Tigervnc tigervnc
X.org
X.org x Server
X.org xwayland

Wed, 26 Feb 2025 02:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Tue, 25 Feb 2025 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 25 Feb 2025 16:00:00 +0000

Type Values Removed Values Added
Description A use-after-free flaw was found in X.Org and Xwayland. When a device is removed while still frozen, the events queued for that device remain while the device is freed. Replaying the events will cause a use-after-free.
Title Xorg: xwayland: use-after-free in playreleasedevents()
First Time appeared Redhat
Redhat enterprise Linux
Weaknesses CWE-416
CPEs cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Redhat Enterprise Linux Rhel Aus Rhel E4s Rhel Els Rhel Eus Rhel Tus
Tigervnc Tigervnc
X.org X Server Xwayland
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-04-06T12:53:29.954Z

Reserved: 2025-02-12T14:12:22.796Z

Link: CVE-2025-26600

cve-icon Vulnrichment

Updated: 2025-11-03T21:13:07.968Z

cve-icon NVD

Status : Modified

Published: 2025-02-25T16:15:39.350

Modified: 2026-04-06T13:17:16.917

Link: CVE-2025-26600

cve-icon Redhat

Severity : Important

Publid Date: 2025-02-25T00:00:00Z

Links: CVE-2025-26600 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-28T12:15:30Z

Weaknesses