A flaw was identified in the X.Org X server and Xwayland components where processing X11 Present extension notifications. During notification creation the server mishandles errors, leaving dangling pointers that trigger a use‑after‑free. This memory corruption can crash the server or, in the worst case, allow an attacker to execute arbitrary code. The weakness is classified as CWE‑416.

All editions of Red Hat Enterprise Linux 6, 7, 8 and 9, including their various extended support and specialized update streams (EUS, AUS, E4S, TUS, etc.) are affected, as is the X.org Xwayland package. The vulnerability stems from the core X server and does not target a specific sub‑component version, so any installation of X.Org X server that is not patched is potentially vulnerable. Users should verify that their systems run the updated X server released by Red Hat in the associated errata (RHSA‑2025:19432 and subsequent pages).

The CVSS score of 7.3 reflects a high impact and moderate complexity, while the EPSS score of less than 1% indicates a very low probability of exploitation at this moment. The vulnerability is not listed in the CISA KEV catalog. The attack vector is likely local, requiring the attacker to be able to send X11 Present notifications to the server, which is typical for a compromised user or for a remote application that can communicate over the X display protocol. Patching remains the primary defense.