HIGH Published February 25, 2025

CVE-2025-26595

A buffer overflow flaw was found in X.Org and Xwayland. The code in XkbVModMaskText() allocates a fixed-sized buffer on the stack and copies the names of the virtual modifiers to that buffer. The code fails to check the bounds of the buffer and would copy the data regardless of the size.

CVSS base score
7.8 (v3.1)
Severity
HIGH
Attack vector
Local
Weakness
CWE-121, CWE-787
Last modified
November 4, 2026
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

tigervnc tigervnc x.org x server x.org xwayland redhat enterprise linux

References

View full NVD advisory →

More tigervnc vulnerabilities

Published the same day

Related reading

← Back to CVE watch