CVE-2025-26597
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
A buffer overflow flaw was found in X.Org and Xwayland. Calling XkbChangeTypesOfKey() with a 0 group resizes the key symbols table to 0 but leaves key actions unchanged. A later call with a non-zero group value causes a buffer overflow because the key actions are of the wrong size.
Risk Assessment
An attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service (DoS) on systems using X.Org or Xwayland, compromising data confidentiality, integrity, and availability.
Recommendation
Immediately update X.Org and Xwayland packages to a patched version. Before updating, consider restricting access to the X server to trusted users only.
Other vulnerabilities in X.Org
See all- CVE-2025-26601High
A use-after-free vulnerability was found in X.Org and Xwayland. When changing an alarm, the change mask values are evaluated sequentially, and if an error occurs, SyncInitTrigger() returns early without adding the new sync object. This can lead to use-after-free when the alarm eventually triggers.
- CVE-2025-26600High
A use-after-free vulnerability was found in X.Org and Xwayland. When a device is removed while frozen, queued events remain after the device is freed. Replaying these events causes a use-after-free.
- CVE-2025-26599High
An access to an uninitialized pointer flaw was found in X.Org and Xwayland. The function compCheckRedirect() may fail if it cannot allocate the backing pixmap. In that case, compRedirectWindow() will return a BadAlloc error without validating the window tree marked just before, which leaves the validated data partly initialized and the use of an uninitialized pointer later.
- CVE-2025-26598High
An out-of-bounds write flaw was found in X.Org and Xwayland. The GetBarrierDevice() function returns the last element of the list instead of NULL when no matching device ID is found, leading to out-of-bounds memory access.
- CVE-2025-26596High
A heap overflow vulnerability was found in X.Org and Xwayland. The discrepancy in length calculation between XkbSizeKeySyms() and XkbWriteKeySyms() may lead to a heap-based buffer overflow.
- CVE-2025-26595High
A buffer overflow flaw was found in X.Org and Xwayland in the XkbVModMaskText() function. The function allocates a fixed-size stack buffer and copies virtual modifier names without bounds checking, potentially leading to overflow.
- CVE-2025-26594High
A use-after-free vulnerability was found in X.Org and Xwayland. The root cursor is stored as a global variable, and if a client frees it, the internal reference points to freed memory, causing a use-after-free.
Original NVD description (English source)
A buffer overflow flaw was found in X.Org and Xwayland. If XkbChangeTypesOfKey() is called with a 0 group, it will resize the key symbols table to 0 but leave the key actions unchanged. If the same function is later called with a non-zero value of groups, this will cause a buffer overflow because the key actions are of the wrong size.