CVE-2025-26598
Full vulnerability record from the local CVENow database.
Description
An out-of-bounds write flaw was found in X.Org and Xwayland. The function GetBarrierDevice() searches for the pointer device based on its device ID and returns the matching value, or supposedly NULL, if no match was found. However, the code will return the last element of the list if no matching device ID is found, which can lead to out-of-bounds memory access.
Severity
HIGH
CVSS score
7.8
(v3.1)
Vulnerability status
Modified
Source identifier
Published
2025-02-25 16:15:38.977000
Last modified
2026-11-04 22:17:30.870000
View original CVE JSON
{
"id": "CVE-2025-26598",
"sourceIdentifier": "[email protected]",
"published": "2025-02-25T16:15:38.977",
"lastModified": "2026-11-04T22:17:30.870",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An out-of-bounds write flaw was found in X.Org and Xwayland. The function GetBarrierDevice() searches for the pointer device based on its device ID and returns the matching value, or supposedly NULL, if no match was found. However, the code will return the last element of the list if no matching device ID is found, which can lead to out-of-bounds memory access."
},
{
"lang": "es",
"value": "Se encontró una falla de escritura fuera de los límites en X.Org y Xwayland. La función GetBarrierDevice() busca el dispositivo puntero en función de su ID de dispositivo y devuelve el valor coincidente, o supuestamente NULL, si no se encuentra ninguna coincidencia. Sin embargo, el código devolverá el último elemento de la lista si no se encuentra ninguna ID de dispositivo coincidente, lo que puede provocar un acceso a la memoria fuera de los límites."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"defaultStatus": "unaffected",
"collectionURL": "https://gitlab.freedesktop.org/xorg/xserver/",
"packageName": "xserver",
"versions": [
{
"version": "0",
"lessThan": "21.1.16",
"versionType": "semver",
"status": "affected"
},
{
"version": "22.0.0",
"lessThan": "24.1.6",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "xorg-x11-server-Xwayland",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.0"
],
"versions": [
{
"version": "0:24.1.5-3.el10_0",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "tigervnc",
"cpes": [
"cpe:/o:redhat:rhel_els:6"
],
"versions": [
{
"version": "0:1.1.0-25.el6_10",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "tigervnc",
"cpes": [
"cpe:/o:redhat:rhel_els:7"
],
"versions": [
{
"version": "0:1.8.0-36.el7_9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "xorg-x11-server",
"cpes": [
"cpe:/o:redhat:rhel_els:7"
],
"versions": [
{
"version": "0:1.20.4-30.el7_9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "tigervnc",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::appstream"
],
"versions": [
{
"version": "0:1.13.1-15.el8_10",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.2 Advanced Update Support",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "tigervnc",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.2::appstream"
],
"versions": [
{
"version": "0:1.9.0-15.el8_2.13",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "tigervnc",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.4::appstream",
"cpe:/a:redhat:rhel_e4s:8.4::appstream",
"cpe:/a:redhat:rhel_tus:8.4::appstream"
],
"versions": [
{
"version": "0:1.11.0-8.el8_4.12",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "tigervnc",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.4::appstream",
"cpe:/a:redhat:rhel_e4s:8.4::appstream",
"cpe:/a:redhat:rhel_tus:8.4::appstream"
],
"versions": [
{
"version": "0:1.11.0-8.el8_4.12",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "tigervnc",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.4::appstream",
"cpe:/a:redhat:rhel_e4s:8.4::appstream",
"cpe:/a:redhat:rhel_tus:8.4::appstream"
],
"versions": [
{
"version": "0:1.11.0-8.el8_4.12",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "tigervnc",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6::appstream",
"cpe:/a:redhat:rhel_e4s:8.6::appstream",
"cpe:/a:redhat:rhel_tus:8.6::appstream"
],
"versions": [
{
"version": "0:1.12.0-6.el8_6.13",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "tigervnc",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6::appstream",
"cpe:/a:redhat:rhel_e4s:8.6::appstream",
"cpe:/a:redhat:rhel_tus:8.6::appstream"
],
"versions": [
{
"version": "0:1.12.0-6.el8_6.13",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "tigervnc",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6::appstream",
"cpe:/a:redhat:rhel_e4s:8.6::appstream",
"cpe:/a:redhat:rhel_tus:8.6::appstream"
],
"versions": [
{
"version": "0:1.12.0-6.el8_6.13",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.8 Extended Update Support",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "tigervnc",
"cpes": [
"cpe:/a:redhat:rhel_eus:8.8::appstream"
],
"versions": [
{
"version": "0:1.12.0-15.el8_8.12",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "tigervnc",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream"
],
"versions": [
{
"version": "0:1.14.1-1.el9_5.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "xorg-x11-server",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/a:redhat:enterprise_linux:9::crb"
],
"versions": [
{
"version": "0:1.20.11-28.el9_6",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "xorg-x11-server-Xwayland",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/a:redhat:enterprise_linux:9::crb"
],
"versions": [
{
"version": "0:23.2.7-3.el9_6",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "tigervnc",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.0::appstream"
],
"versions": [
{
"version": "0:1.11.0-22.el9_0.13",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.2 Extended Update Support",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "tigervnc",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.2::appstream"
],
"versions": [
{
"version": "0:1.12.0-14.el9_2.10",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "tigervnc",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.4::appstream"
],
"versions": [
{
"version": "0:1.13.1-8.el9_4.5",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
"defaultStatus": "unknown",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "xorg-x11-server",
"cpes": [
"cpe:/o:redhat:rhel_els:6"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "xorg-x11-server",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "xorg-x11-server-Xwayland",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-02-25T16:24:04.385893Z",
"id": "CVE-2025-26598",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-787"
}
]
},
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-787"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:tigervnc:tigervnc:-:*:*:*:*:*:*:*",
"matchCriteriaId": "79A8316C-BA22-441E-92AF-415AFABCEB76"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:x.org:x_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "21.1.16",
"matchCriteriaId": "07E5F462-A20F-472C-85E7-804D46F01A7A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:*",
"versionEndExcluding": "24.1.6",
"matchCriteriaId": "1CBC57E6-F54D-4B54-9263-9753CCA3EEF7"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "142AD0DD-4CF3-4D74-9442-459CE3347E3A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F4CFF558-3C47-480D-A2F0-BABF26042943"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7F6FB57C-2BC7-487C-96DD-132683AEB35D"
}
]
}
]
}
],
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2025:2500",
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:2502",
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:2861",
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:2862",
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:2865",
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:2866",
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:2873",
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:2874",
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:2875",
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:2879",
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:2880",
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:3976",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:7163",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:7165",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:7458",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-26598",
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2345254",
"source": "[email protected]",
"tags": [
"Issue Tracking"
]
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00036.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
]
}