HIGH Published February 25, 2025

CVE-2025-26599

An access to an uninitialized pointer flaw was found in X.Org and Xwayland. The function compCheckRedirect() may fail if it cannot allocate the backing pixmap. In that case, compRedirectWindow() will return a BadAlloc error without validating the window tree marked just before, which leaves the validated data partly initialized and the use of an uninitialized pointer later.

CVSS base score

7.8 (v3.1)

Severity

HIGH

Attack vector

Local

Weakness

CWE-824

Last modified

November 4, 2026

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

tigervnc tigervnc x.org x server x.org xwayland redhat enterprise linux

References

access.redhat.com Third Party Advisory
access.redhat.com Third Party Advisory
access.redhat.com Third Party Advisory
access.redhat.com Third Party Advisory
access.redhat.com Third Party Advisory
access.redhat.com Third Party Advisory
access.redhat.com Third Party Advisory
access.redhat.com Third Party Advisory
access.redhat.com Third Party Advisory
access.redhat.com Third Party Advisory

View full NVD advisory →

More tigervnc vulnerabilities

Published the same day

← Back to CVE watch

CVE-2025-26599

Affected products

References

More tigervnc vulnerabilities

Published the same day

Related reading