PatchaPalooza

CVE-2025-26599: Xorg: xwayland: use of uninitialized pointer in compredirectwindow()

CVE-2025-26599 is a vulnerability in Xorg: xwayland: use of uninitialized pointer in compredirectwindow(), rated Important by Microsoft, with a CVSS 3.1 base score of 7.8 (High). An attacker can exploit it by an attacker with local access, with low privileges and without user interaction. Microsoft has not reported exploitation in the wild. The EPSS model estimates a 0.40% probability of exploitation activity in the next 30 days, higher than 35% of all scored vulnerabilities. Microsoft released the fix on 9 March 2025 in the February 2025 Patch Tuesday. It affects 4 products in 2 product families (Mariner, Open Source Software).

Key facts

CVE ID
CVE-2025-26599
Severity
High CVSS 7.8
Microsoft severity
Important
Exploited in the wild
No
Publicly disclosed
No
Weakness
CWE-824
EPSS
0.40% (percentile 35%)
CISA KEV
Not listed
Released
Last updated
Patch Tuesday
February 2025 Patch Tuesday
Product families
Mariner, Open Source Software

CVSS score and vector

Microsoft scores CVE-2025-26599 at 7.8 (temporal 7.8) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

MetricValue
Attack vectorLocal
Attack complexityLow
Privileges requiredLow
User interactionNone
ScopeUnchanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh

Frequently asked questions (Microsoft)

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?

One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.

Affected products (4)

Mariner

ProductSecurity updateTypeFixed buildRestart
azl3 xorg-x11-server-Xwayland 24.1.1-3 on Azure Linux 3.0CBL-Mariner ReleasesSecurity Update24.1.6-1No
azl3 xorg-x11-server-Xwayland 24.1.6-1 on Azure Linux 3.0CBL-Mariner ReleasesSecurity Update24.1.6-1No

Open Source Software

ProductSecurity updateTypeFixed buildRestart
cbl2 xorg-x11-server 1.20.10-15 on CBL Mariner 2.0CBL-Mariner ReleasesSecurity Update1.20.10-15No
cbl2 xorg-x11-server 1.20.10-15 on CBL-Mariner 2.0CBL-Mariner ReleasesSecurity Update1.20.10-15No

NIST NVD data

NVD status
Modified
NVD CVSS
7.8 (HIGH)
NVD weakness
CWE-824
Published to NVD
NVD last modified

Affected configurations (CPE)

ProductVulnerable versions
tigervncall listed versions
x serverbefore 21.1.16
xwaylandbefore 24.1.6
enterprise linux 7.0all listed versions
enterprise linux 8.0all listed versions
enterprise linux 9.0all listed versions

References

Revision history

VersionDateDescription
1.0Information published.
2.0Information published.
2.1Information published.
3.0Information published.

Sources