---
id: CVE-2025-26599
title: An access to an uninitialized pointer flaw was found in X.Org and Xwayland
summary: >-
  An access to an uninitialized pointer flaw was found in X.Org and Xwayland.
  The function compCheckRedirect() may fail if it cannot allocate the backing
  pixmap. In that case, compRedirectWindow() will return a BadAlloc error
  without valid…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-824
  - CWE-824
vendor: tigervnc
product: tigervnc
affected:
  - tigervnc
  - x_server < 21.1.16
  - xwayland < 24.1.6
  - enterprise_linux = 7.0
  - enterprise_linux = 8.0
  - enterprise_linux = 9.0
patched:
  - x_server 21.1.16
  - xwayland 24.1.6
published: '2025-02-25'
updated: '2026-06-25'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-26599'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2025:2500'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:2502'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:2861'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:2862'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:2865'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:2866'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:2873'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:2874'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:2875'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:2879'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:2880'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:3976'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:7163'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:7165'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:7458'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/security/cve/CVE-2025-26599'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2345253'
    label: secalert@redhat.com
  - url: 'https://lists.debian.org/debian-lts-announce/2025/02/msg00036.html'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.00405
epssPercentile: 0.34531
ingestedAt: '2026-06-29T13:24:34.170Z'
---

## Overview

An access to an uninitialized pointer flaw was found in X.Org and Xwayland. The function compCheckRedirect() may fail if it cannot allocate the backing pixmap. In that case, compRedirectWindow() will return a BadAlloc error without validating the window tree marked just before, which leaves the validated data partly initialized and the use of an uninitialized pointer later.

## Affected

- `tigervnc`
- `x_server < 21.1.16`
- `xwayland < 24.1.6`
- `enterprise_linux = 7.0`
- `enterprise_linux = 8.0`
- `enterprise_linux = 9.0`

## Remediation

Upgrade past the affected range:

- `x_server 21.1.16`
- `xwayland 24.1.6`