CVE-2025-26594

Summary

CVE-2025-26594 is a use-after-free vulnerability affecting X.Org and Xwayland. In these systems, the root cursor is handled as a global variable within the X server. If a client successfully frees the root cursor, the server's internal reference continues to point to the freed memory, leading to unintended memory access and potential code execution or crash. This issue poses a significant risk to the security and stability of affected systems.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.