---
id: CVE-2025-26598
title: An out-of-bounds write flaw was found in X.Org and Xwayland
summary: >-
  An out-of-bounds write flaw was found in X.Org and Xwayland. The function
  GetBarrierDevice() searches for the pointer device based on its device ID and
  returns the matching value, or supposedly NULL, if no match was found.
  However, the c…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-787
  - CWE-787
vendor: tigervnc
product: tigervnc
affected:
  - tigervnc
  - x_server < 21.1.16
  - xwayland < 24.1.6
  - enterprise_linux = 7.0
  - enterprise_linux = 8.0
  - enterprise_linux = 9.0
patched:
  - x_server 21.1.16
  - xwayland 24.1.6
published: '2025-02-25'
updated: '2026-06-25'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-26598'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2025:2500'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:2502'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:2861'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:2862'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:2865'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:2866'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:2873'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:2874'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:2875'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:2879'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:2880'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:3976'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:7163'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:7165'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:7458'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/security/cve/CVE-2025-26598'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2345254'
    label: secalert@redhat.com
  - url: 'https://lists.debian.org/debian-lts-announce/2025/02/msg00036.html'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.00405
epssPercentile: 0.31998
ingestedAt: '2026-06-29T13:24:34.169Z'
---

## Overview

An out-of-bounds write flaw was found in X.Org and Xwayland. The function GetBarrierDevice() searches for the pointer device based on its device ID and returns the matching value, or supposedly NULL, if no match was found. However, the code will return the last element of the list if no matching device ID is found, which can lead to out-of-bounds memory access.

## Affected

- `tigervnc`
- `x_server < 21.1.16`
- `xwayland < 24.1.6`
- `enterprise_linux = 7.0`
- `enterprise_linux = 8.0`
- `enterprise_linux = 9.0`

## Remediation

Upgrade past the affected range:

- `x_server 21.1.16`
- `xwayland 24.1.6`