← back
CVE-2025-26594highCWE-416

X.org: xwayland: use-after-free of the root cursor

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.8epss 0.4%
exploitation probability
0.4%top 69% of all CVEs
observed exploitation
nono source reports it
A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a global variable. If a client frees the root cursor, the internal reference points to freed memory and causes a use-after-free.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H