Xorg: xmayland: use-after-free in xpresentnotify structure creation

Summary

A flaw was found in the X.Org X server and Xwayland when processing X11 Present extension notifications. Improper error handling during notification creation can leave dangling pointers that lead to a use-after-free condition. This can cause memory corruption or a crash, potentially allowing an attacker to execute arbitrary code or cause a denial of service.

Timeline

1. Oct 30, 2025, 5:28 AM UTCCVE published
2. Oct 31, 2025, 3:55 AM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Apr 20, 2026, 1:50 PM UTCRecord last updated

Affected versions

• xwayland

  From 1.15.0 · fixed in 24.1.9

• xorg-x11-server-Xwayland

  Version range not reported

• xorg-x11-server-Xwayland

  Version range not reported

• tigervnc

  Version range not reported

• xorg-x11-server

  Version range not reported

• tigervnc

  Version range not reported

• xorg-x11-server-Xwayland

  Version range not reported

• xorg-x11-server

  Version range not reported

• tigervnc

  Version range not reported

• tigervnc

  Version range not reported

• xorg-x11-server

  Version range not reported

• tigervnc

  Version range not reported

• xorg-x11-server

  Version range not reported

• tigervnc

  Version range not reported

• xorg-x11-server

  Version range not reported

• tigervnc

  Version range not reported

• xorg-x11-server

  Version range not reported

• xorg-x11-server-Xwayland

  Version range not reported

• tigervnc

  Version range not reported

• xorg-x11-server

  Version range not reported

• xorg-x11-server-Xwayland

  Version range not reported

• tigervnc

  Version range not reported

• xorg-x11-server

  Version range not reported

• xorg-x11-server-Xwayland

  Version range not reported

• tigervnc

  Version range not reported

• xorg-x11-server

  Version range not reported

• xorg-x11-server-Xwayland

  Version range not reported

• tigervnc

  Version range not reported

• xorg-x11-server

  Version range not reported

• xorg-x11-server-Xwayland

  Version range not reported

• xorg-x11-server

  Version range not reported

• tigervnc

  Version range not reported

• xorg-x11-server-Xwayland

  Version range not reported

• tigervnc

  Version range not reported

• xorg-x11-server-Xwayland

  Version range not reported

• xorg-x11-server

  Version range not reported

• tigervnc

  Version range not reported

• xorg-x11-server

  Version range not reported

• xorg-x11-server-Xwayland

  Version range not reported

• tigervnc

  Version range not reported

• xorg-x11-server

  Version range not reported

• xorg-x11-server-Xwayland

  Version range not reported

• tigervnc

  Version range not reported

• xorg-x11-server

  Version range not reported

• xorg-x11-server-Xwayland

  Version range not reported

• xorg-x11-server

  Version range not reported

References 25