CVE-2025-26599

Estado: ModificadaAlta (7.8)—
An access to an uninitialized pointer flaw was found in X.Org and Xwayland. The function compCheckRedirect() may fail if it cannot allocate the backing pixmap. In that case, compRedirectWindow() will return a BadAlloc error without validating the window tree marked just before, which leaves the validated data partly initialized and the use of an uninitialized pointer later.
CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 7.8
Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.40%
Percentil entre todas las CVEs puntuadas: 33
Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
ExplotaciónT1068 Exploitation for Privilege Escalationprivilege escalation85 %
Impacto principalT1059 Command and Scripting Interpreterexecution80 %
Acceso local (AV:L) sin interacción (UI:N) con privilegios de usuario (PR:L) permite escalada de privilegios mediante puntero no inicializado en X.Org/Xwayland. Impacto: ejecución de código arbitrario con privilegios elevados.
Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.
🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Execution Prevention Threat Intelligence Program Restrict Web-Based Content Privileged Account Management Limit Software Installation Behavior Prevention on Endpoint
Tecnologías afectadas (4)

Redhat — Enterprise Linux Tigervnc — Tigervnc X.org — X Server X.org — Xwayland
CWE

CWE-824
CWE-824
Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-26599",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-26599",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-02-25T16:22:35.562208Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "secalert@redhat.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "21.1.16",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "22.0.0",
              "lessThan": "24.1.6",
              "versionType": "semver"
            }
          ],
          "packageName": "xserver",
          "collectionURL": "https://gitlab.freedesktop.org/xorg/xserver/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.0"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 10",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:24.1.5-3.el10_0",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "xorg-x11-server-Xwayland",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/o:redhat:rhel_els:6"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 6 Extended Lifecycle Support  - EXTENSION",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:1.1.0-25.el6_10",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "tigervnc",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/o:redhat:rhel_els:7"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:1.8.0-36.el7_9",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "tigervnc",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/o:redhat:rhel_els:7"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:1.20.4-30.el7_9",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "xorg-x11-server",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:1.13.1-15.el8_10",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "tigervnc",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.2::appstream"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8.2 Advanced Update Support",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:1.9.0-15.el8_2.13",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "tigervnc",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_e4s:8.4::appstream",
            "cpe:/a:redhat:rhel_tus:8.4::appstream"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:1.11.0-8.el8_4.12",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "tigervnc",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_e4s:8.4::appstream",
            "cpe:/a:redhat:rhel_tus:8.4::appstream"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:1.11.0-8.el8_4.12",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "tigervnc",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_e4s:8.4::appstream",
            "cpe:/a:redhat:rhel_tus:8.4::appstream"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:1.11.0-8.el8_4.12",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "tigervnc",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::appstream"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:1.12.0-6.el8_6.13",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "tigervnc",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::appstream"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:1.12.0-6.el8_6.13",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "tigervnc",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::appstream"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:1.12.0-6.el8_6.13",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "tigervnc",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_eus:8.8::appstream"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8.8 Extended Update Support",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:1.12.0-15.el8_8.12",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "tigervnc",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:1.14.1-1.el9_5.1",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "tigervnc",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/a:redhat:enterprise_linux:9::crb"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:1.20.11-28.el9_6",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "xorg-x11-server",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/a:redhat:enterprise_linux:9::crb"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:23.2.7-3.el9_6",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "xorg-x11-server-Xwayland",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.0::appstream"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:1.11.0-22.el9_0.13",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "tigervnc",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.2::appstream"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9.2 Extended Update Support",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:1.12.0-14.el9_2.10",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "tigervnc",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.4::appstream"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:1.13.1-8.el9_4.5",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "tigervnc",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 6",
          "packageName": "xorg-x11-server",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8",
          "packageName": "xorg-x11-server",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8",
          "packageName": "xorg-x11-server-Xwayland",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-02-25T16:15:39.163",
  "references": [
    {
      "url": "https://access.redhat.com/errata/RHSA-2025:2500",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2025:2502",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2025:2861",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2025:2862",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2025:2865",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2025:2866",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2025:2873",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2025:2874",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2025:2875",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2025:2879",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2025:2880",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2025:3976",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2025:7163",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2025:7165",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2025:7458",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2025-26599",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2345253",
      "tags": [
        "Issue Tracking"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00036.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secalert@redhat.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-824"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-824"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An access to an uninitialized pointer flaw was found in X.Org and Xwayland. The function compCheckRedirect() may fail if it cannot allocate the backing pixmap. In that case, compRedirectWindow() will return a BadAlloc error without validating the window tree marked just before, which leaves the validated data partly initialized and the use of an uninitialized pointer later."
    },
    {
      "lang": "es",
      "value": "Se encontró un error en el acceso a un puntero no inicializado en X.Org y Xwayland. La función compCheckRedirect() puede fallar si no puede asignar el mapa de píxeles de respaldo. En ese caso, compRedirectWindow() devolverá un error BadAlloc sin validar el árbol de ventanas marcado justo antes, lo que deja los datos validados parcialmente inicializados y el uso de un puntero no inicializado más adelante."
    }
  ],
  "lastModified": "2026-06-29T21:16:34.477",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tigervnc:tigervnc:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "79A8316C-BA22-441E-92AF-415AFABCEB76"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:x.org:x_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "07E5F462-A20F-472C-85E7-804D46F01A7A",
              "versionEndExcluding": "21.1.16"
            },
            {
              "criteria": "cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1CBC57E6-F54D-4B54-9263-9753CCA3EEF7",
              "versionEndExcluding": "24.1.6"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "142AD0DD-4CF3-4D74-9442-459CE3347E3A"
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F4CFF558-3C47-480D-A2F0-BABF26042943"
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7F6FB57C-2BC7-487C-96DD-132683AEB35D"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}