Xorg: xwayland: use-after-free in syncinittrigger()

CISA ADP · SSVC 2.0.3

Exploitation

None

Automatable

No

Technical impact

Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

• xserver Vendor— Affected before 21.1.16; 22.0.0 to before 24.1.6 Fixed in 21.1.16, 24.1.6 Patch available CNA
• Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in 24.1.5-3.el10_0 Patch available CNA
• Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION VendorRed Hat Affected — Fixed in 1.1.0-25.el6_10 Patch available CNA
• Red Hat Enterprise Linux 7 Extended Lifecycle Support VendorRed Hat Affected — Fixed in 1.8.0-36.el7_9 Patch available CNA
• Red Hat Enterprise Linux 7 Extended Lifecycle Support VendorRed Hat Affected — Fixed in 1.20.4-30.el7_9 Patch available CNA
• Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 1.13.1-15.el8_10 Patch available CNA
• Red Hat Enterprise Linux 8.2 Advanced Update Support VendorRed Hat Affected — Fixed in 1.9.0-15.el8_2.13 Patch available CNA
• Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 1.11.0-8.el8_4.12 Patch available CNA
• Red Hat Enterprise Linux 8.4 Telecommunications Update Service VendorRed Hat Affected — Fixed in 1.11.0-8.el8_4.12 Patch available CNA
• Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 1.11.0-8.el8_4.12 Patch available CNA
• Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 1.12.0-6.el8_6.13 Patch available CNA
• Red Hat Enterprise Linux 8.6 Telecommunications Update Service VendorRed Hat Affected — Fixed in 1.12.0-6.el8_6.13 Patch available CNA
• Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 1.12.0-6.el8_6.13 Patch available CNA
• Red Hat Enterprise Linux 8.8 Extended Update Support VendorRed Hat Affected — Fixed in 1.12.0-15.el8_8.12 Patch available CNA
• Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 1.14.1-1.el9_5.1 Patch available CNA
• Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 1.20.11-28.el9_6 Patch available CNA
• Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 23.2.7-3.el9_6 Patch available CNA
• Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 1.11.0-22.el9_0.13 Patch available CNA
• Red Hat Enterprise Linux 9.2 Extended Update Support VendorRed Hat Affected — Fixed in 1.12.0-14.el9_2.10 Patch available CNA
• Red Hat Enterprise Linux 9.4 Extended Update Support VendorRed Hat Affected — Fixed in 1.13.1-8.el9_4.5 Patch available CNA
• Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
• Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — Not affected CNA
• Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — Not affected CNA

• Fix · CNA xserver Fixed in 21.1.16, 24.1.6

Records fixed by the same vendor advisory or release, as the CNA lists them.

• Advisory · 2025-02-25

  Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6 and 15 more products — RHSA-2025:2500

  8 records · Highest priority Priority LOW · 8 LOW

  Other records, highest priority first

  • TI-2025-19538 Xorg: xwayland: use-after-free in playreleasedevents()Priority LOW 36
  • TI-2025-19537 Xorg: xwayland: use of uninitialized pointer in compredirectwindow()Priority LOW 36
  • TI-2025-19536 Xorg: xwayland: out-of-bounds write in createpointerbarrierclient()Priority LOW 36
  Show all 8 records → Advisory →
• Advisory · 2025-02-25

  Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6 and 15 more products — RHSA-2025:2502

  8 records · Highest priority Priority LOW · 8 LOW

  Other records, highest priority first

  • TI-2025-19538 Xorg: xwayland: use-after-free in playreleasedevents()Priority LOW 36
  • TI-2025-19537 Xorg: xwayland: use of uninitialized pointer in compredirectwindow()Priority LOW 36
  • TI-2025-19536 Xorg: xwayland: out-of-bounds write in createpointerbarrierclient()Priority LOW 36
  Show all 8 records → Advisory →

1. 2026-10-02 Threatist record created from CVE-2025-26601
2. 2026-10-03 Alias added: GHSA-gf8x-6jh7-3mjv

• TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
• TI-2018-10530 Code injection in [UNKNOWN] RichFaces KEVCVSS 3.1CRITICAL 9.8
• TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
• TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
• TI-2025-23530 Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf… KEVCVSS 3.1CRITICAL 9.3
• TI-2021-17490 mod_proxy SSRF KEVCVSS 3.1CRITICAL 9.0

• CVE-2025-26601 · CVE Program
• CVE-2025-26601 · NVD
• FIRST EPSS
• GHSA-gf8x-6jh7-3mjv · GitHub Advisory Database · CC BY 4.0
• CVE-2025-26601 · Red Hat security data · CC BY 4.0

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences