CVE-2025-26600
CVSS 3.1 Score 7.8 of 10 (high)
Details
Published Feb 25, 2025
Updated: Mar 10, 2025
CWE ID 416
Summary
CVE-2025-26600 is a use-after-free vulnerability affecting X.Org and Xwayland. When a device is removed while still frozen, events queued for that device persist, but the device is concurrently freed. Subsequently replaying these events can result in a use-after-free condition, potentially leading to arbitrary code execution or denial of service. This vulnerability poses a significant risk to systems utilizing X.Org or Xwayland, particularly in environments where devices are frequently added or removed.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Red Hat Enterprise Linux
Affected Vendors
- Red Hat