CVE-2025-26598
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
An out-of-bounds write flaw was found in X.Org and Xwayland. The GetBarrierDevice() function returns the last element of the list instead of NULL when no matching device ID is found, leading to out-of-bounds memory access.
Risk Assessment
An attacker could exploit this vulnerability to gain unauthorized memory access, potentially causing system crashes or arbitrary code execution.
Recommendation
Immediately update X.Org and Xwayland packages to versions containing the fix for the GetBarrierDevice() function.
Other vulnerabilities in X.Org
See all- CVE-2025-26601High
A use-after-free vulnerability was found in X.Org and Xwayland. When changing an alarm, the change mask values are evaluated sequentially, and if an error occurs, SyncInitTrigger() returns early without adding the new sync object. This can lead to use-after-free when the alarm eventually triggers.
- CVE-2025-26600High
A use-after-free vulnerability was found in X.Org and Xwayland. When a device is removed while frozen, queued events remain after the device is freed. Replaying these events causes a use-after-free.
- CVE-2025-26599High
An access to an uninitialized pointer flaw was found in X.Org and Xwayland. The function compCheckRedirect() may fail if it cannot allocate the backing pixmap. In that case, compRedirectWindow() will return a BadAlloc error without validating the window tree marked just before, which leaves the validated data partly initialized and the use of an uninitialized pointer later.
- CVE-2025-26597High
A buffer overflow flaw was found in X.Org and Xwayland. Calling XkbChangeTypesOfKey() with a 0 group resizes the key symbols table to 0 but leaves key actions unchanged. A later call with a non-zero group value causes a buffer overflow because the key actions are of the wrong size.
- CVE-2025-26596High
A heap overflow vulnerability was found in X.Org and Xwayland. The discrepancy in length calculation between XkbSizeKeySyms() and XkbWriteKeySyms() may lead to a heap-based buffer overflow.
- CVE-2025-26595High
A buffer overflow flaw was found in X.Org and Xwayland in the XkbVModMaskText() function. The function allocates a fixed-size stack buffer and copies virtual modifier names without bounds checking, potentially leading to overflow.
- CVE-2025-26594High
A use-after-free vulnerability was found in X.Org and Xwayland. The root cursor is stored as a global variable, and if a client frees it, the internal reference points to freed memory, causing a use-after-free.
Original NVD description (English source)
An out-of-bounds write flaw was found in X.Org and Xwayland. The function GetBarrierDevice() searches for the pointer device based on its device ID and returns the matching value, or supposedly NULL, if no match was found. However, the code will return the last element of the list if no matching device ID is found, which can lead to out-of-bounds memory access.