---
id: CVE-2025-62230
title: >-
  A flaw was discovered in the X.Org X server’s X Keyboard (Xkb) extension when
  handling client resource cleanup
summary: >-
  A flaw was discovered in the X.Org X server’s X Keyboard (Xkb) extension when
  handling client resource cleanup. The software frees certain data structures
  without properly detaching related resources, leading to a use-after-free
  conditio…
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H'
cwe:
  - CWE-416
published: '2025-10-30'
updated: '2026-06-29'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-62230'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2025:19432'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:19433'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:19434'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:19435'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:19489'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:19623'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:19909'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:20958'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:20960'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:20961'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:21035'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:22040'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:22041'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:22051'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:22055'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:22056'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:22077'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:22096'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:22164'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:22167'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:22364'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:22365'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:22426'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:22427'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:22667'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:22729'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:22742'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:22753'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:0031'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:0033'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:0034'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:0035'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:0036'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/security/cve/CVE-2025-62230'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2402653'
    label: secalert@redhat.com
  - url: 'https://lists.x.org/archives/xorg-announce/2025-October/003635.html'
    label: secalert@redhat.com
  - url: 'http://www.openwall.com/lists/oss-security/2025/10/28/7'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2025/10/msg00033.html'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.00263
epssPercentile: 0.16165
ingestedAt: '2026-06-29T21:48:47.214Z'
---

## Overview

A flaw was discovered in the X.Org X server’s X Keyboard (Xkb) extension when handling client resource cleanup. The software frees certain data structures without properly detaching related resources, leading to a use-after-free condition. This can cause memory corruption or a crash when affected clients disconnect.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.