← back
CVE-2025-26601

Xorg: xwayland: use-after-free in syncinittrigger()

CVSS 7.8 HIGHEPSS 0.4%CWE-416
Vexday Risk Score
21Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 7.8EPSS 0.4%KEV nãoPoC Nuclei Metasploit Patch referenciado
Lifecycle
25 Feb 2025Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
A use-after-free flaw was found in X.Org and Xwayland. When changing an alarm, the values of the change mask are evaluated one after the other, changing the trigger values as requested, and eventually, SyncInitTrigger() is called. If one of the changes triggers an error, the function will return early, not adding the new sync object, possibly causing a use-after-free when the alarm eventually triggers.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →