A use‑after‑free flaw exists in the present_clear_window_notifies() routine of the X.org X Server (versions prior to 21.1.25) and X Wayland (versions prior to 24.1.14). When a malicious X client requests cross‑window notifications and subsequently deletes the target window, the server accesses memory that has already been freed. This invalid memory reference can cause the X server to crash, or, in a worst‑case scenario, execute arbitrary code in the server process. The vulnerability is categorized as CWE-416 (Use‑After‑Free) and CWE-825. Because the exploit operates entirely in the local X client context, the primary consequence is a denial of service that affects all users attached to that X server.

The vulnerability affects the xorg‑x11‑server package and the xwayland component. All installations of these packages that include the Present extension and are running versions older than 21.1.25 for xorg‑x11‑server or 24.1.14 for xwayland may be impacted.

The CVSS score of 6.8 indicates a moderate level of severity. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is local; it requires an attacker to run a malicious X client that can orchestrate cross‑window notifications and delete the target window. No elevated privileges or network connectivity beyond what is normally available to a local X client are needed. Successful exploitation leads to an X server crash, disrupting service for all users connected to that instance. While the description mentions the potential for code execution, the primary and most assured outcome is denial of service.