Login Sign Up

CVE-2025-26599

7.8 HIGH
Denial of Service

📋 TL;DR

This CVE describes an uninitialized pointer vulnerability in X.Org and Xwayland display servers. When compCheckRedirect() fails to allocate a backing pixmap, compRedirectWindow() returns a BadAlloc error without properly cleaning up partially initialized window tree data, leading to potential use of an uninitialized pointer. This affects systems running X.Org Server or Xwayland with compositing enabled.

💻 Affected Systems

Products:
  • X.Org Server
  • Xwayland
Versions: Specific versions not detailed in references; check Red Hat advisories for affected releases.
Operating Systems: Linux distributions using affected X.Org/Xwayland versions
Default Config Vulnerable: ⚠️ Yes
Notes: Requires compositing to be enabled; typical desktop environments use compositing by default.

📦 What is this software?

Enterprise Linux by Redhat

View all CVEs affecting Enterprise Linux →

Enterprise Linux by Redhat

View all CVEs affecting Enterprise Linux →

Enterprise Linux by Redhat

View all CVEs affecting Enterprise Linux →

Tigervnc by Tigervnc

View all CVEs affecting Tigervnc →

X Server by X.org

View all CVEs affecting X Server →

Xwayland by X.org

View all CVEs affecting Xwayland →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local privilege escalation to root, arbitrary code execution, or system crash leading to denial of service.

🟠

Likely Case

Application crashes, denial of service affecting graphical sessions, or limited information disclosure.

🟢

If Mitigated

Minimal impact with proper access controls and isolation; crashes contained to user session.

🌐 Internet-Facing: LOW - Requires local access to graphical session; not directly exploitable over network.
🏢 Internal Only: MEDIUM - Local attackers with graphical session access could exploit; risk increases with multi-user systems.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ✅ No
Complexity: MEDIUM

Exploitation requires local access to a graphical session and knowledge of memory layout; no public exploits known.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Check Red Hat advisories RHSA-2025:2500, RHSA-2025:2502, RHSA-2025:2861, RHSA-2025:2862, RHSA-2025:2865 for specific patched versions.

Vendor Advisory: https://access.redhat.com/errata/RHSA-2025:2500

Restart Required: No

Instructions:

1. Update X.Org/Xwayland packages using your distribution's package manager. 2. For Red Hat systems: 'yum update' or 'dnf update' followed by package restart. 3. Restart graphical sessions to apply changes.

🔧 Temporary Workarounds

Disable compositing

all

Temporarily disable window compositing to mitigate the vulnerability.

Check desktop environment settings to disable compositing/effects

🧯 If You Can't Patch

  • Restrict local access to graphical sessions using access controls.
  • Monitor for crashes in X.Org/Xwayland processes and investigate anomalies.

🔍 How to Verify

Check if Vulnerable:

Check installed X.Org/Xwayland version against patched versions in Red Hat advisories.

Check Version:

For X.Org: 'Xorg -version'; For Xwayland: 'Xwayland -version' or check package version with 'rpm -q xorg-x11-server' or 'dpkg -l xserver-xorg-core'

Verify Fix Applied:

Verify package version after update matches patched version from vendor advisory.

📡 Detection & Monitoring

Log Indicators:

  • X.Org/Xwayland crash logs in /var/log/Xorg.0.log
  • Application crashes related to BadAlloc errors

Network Indicators:

  • None - local exploitation only

SIEM Query:

Search for 'BadAlloc' or 'segmentation fault' in X.Org logs or system logs from X server processes.

📊 Metadata

CVE ID: CVE-2025-26599
CVSS v3 Score: 7.8 (HIGH)
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-824
EPSS Score: 0.05% exploit probability (16.1th percentile)
Published: February 25, 2025
Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-26599, you might also want to check these:

CVE-2020-11138 9.8

This vulnerability allows attackers to exploit uninitialized pointers during music playback in Qualc...

Same vulnerability type (CWE-824)
CVE-2022-44451 9.8

This vulnerability allows arbitrary code execution through a use of uninitialized pointer in Open Ba...

Same vulnerability type (CWE-824)
CVE-2025-66588 9.8

An uninitialized pointer vulnerability in AzeoTech DAQFactory allows attackers to execute arbitrary ...

Same vulnerability type (CWE-824)