CVE-2025-26599

Summary

CVE-2025-26599 is a newly disclosed vulnerability affecting X.Org and Xwayland. This issue involves an uninitialized pointer flaw in the function compCheckRedirect(). If the function fails to allocate a backing pixmap, compRedirectWindow() returns an error without properly validating the window tree. Consequently, data remains partly initialized, exposing the risk of using an uninitialized pointer later in the code. This vulnerability can lead to arbitrary code execution or denial of service attacks if exploited successfully.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.