HIGH Published February 25, 2025

CVE-2025-26596

A heap overflow flaw was found in X.Org and Xwayland. The computation of the length in XkbSizeKeySyms() differs from what is written in XkbWriteKeySyms(), which may lead to a heap-based buffer overflow.

CVSS base score

7.8 (v3.1)

Severity

HIGH

Attack vector

Local

Weakness

CWE-787

Last modified

November 4, 2026

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

tigervnc tigervnc x.org x server x.org xwayland redhat enterprise linux

References

access.redhat.com Third Party Advisory
access.redhat.com Third Party Advisory
access.redhat.com Third Party Advisory
access.redhat.com Third Party Advisory
access.redhat.com Third Party Advisory
access.redhat.com Third Party Advisory
access.redhat.com Third Party Advisory
access.redhat.com Third Party Advisory
access.redhat.com Third Party Advisory
access.redhat.com Third Party Advisory

View full NVD advisory →

More tigervnc vulnerabilities

Published the same day

← Back to CVE watch

CVE-2025-26596

Affected products

References

More tigervnc vulnerabilities

Published the same day

Related reading