CVE-2025-26595
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
A buffer overflow flaw was found in X.Org and Xwayland in the XkbVModMaskText() function. The function allocates a fixed-size stack buffer and copies virtual modifier names without bounds checking, potentially leading to overflow.
Risk Assessment
An attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service, compromising confidentiality, integrity, and availability.
Recommendation
Immediately update X.Org and Xwayland packages to versions containing the fix for the buffer overflow.
Other vulnerabilities in X.Org
See all- CVE-2025-26601High
A use-after-free vulnerability was found in X.Org and Xwayland. When changing an alarm, the change mask values are evaluated sequentially, and if an error occurs, SyncInitTrigger() returns early without adding the new sync object. This can lead to use-after-free when the alarm eventually triggers.
- CVE-2025-26600High
A use-after-free vulnerability was found in X.Org and Xwayland. When a device is removed while frozen, queued events remain after the device is freed. Replaying these events causes a use-after-free.
- CVE-2025-26599High
An access to an uninitialized pointer flaw was found in X.Org and Xwayland. The function compCheckRedirect() may fail if it cannot allocate the backing pixmap. In that case, compRedirectWindow() will return a BadAlloc error without validating the window tree marked just before, which leaves the validated data partly initialized and the use of an uninitialized pointer later.
- CVE-2025-26598High
An out-of-bounds write flaw was found in X.Org and Xwayland. The GetBarrierDevice() function returns the last element of the list instead of NULL when no matching device ID is found, leading to out-of-bounds memory access.
- CVE-2025-26597High
A buffer overflow flaw was found in X.Org and Xwayland. Calling XkbChangeTypesOfKey() with a 0 group resizes the key symbols table to 0 but leaves key actions unchanged. A later call with a non-zero group value causes a buffer overflow because the key actions are of the wrong size.
- CVE-2025-26596High
A heap overflow vulnerability was found in X.Org and Xwayland. The discrepancy in length calculation between XkbSizeKeySyms() and XkbWriteKeySyms() may lead to a heap-based buffer overflow.
- CVE-2025-26594High
A use-after-free vulnerability was found in X.Org and Xwayland. The root cursor is stored as a global variable, and if a client frees it, the internal reference points to freed memory, causing a use-after-free.
Original NVD description (English source)
A buffer overflow flaw was found in X.Org and Xwayland. The code in XkbVModMaskText() allocates a fixed-sized buffer on the stack and copies the names of the virtual modifiers to that buffer. The code fails to check the bounds of the buffer and would copy the data regardless of the size.