Description
A buffer overflow flaw was found in X.Org and Xwayland. The code in XkbVModMaskText() allocates a fixed-sized buffer on the stack and copies the names of the virtual modifiers to that buffer. The code fails to check the bounds of the buffer and would copy the data regardless of the size.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | xserver | < 21.1.16, 22.0.0 – < 24.1.6 | 21.1.16 |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION | — | — |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 8.2 Advanced Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | xorg-server | 2:21.1.16-1 | — |
| Debian 14 | xwayland | 2:24.1.6-1 | — |
| Debian 13 | xorg-server | 2:21.1.16-1 | — |
| Debian 13 | xwayland | 2:24.1.6-1 | — |
| Debian 12 | xorg-server | 2:21.1.7-3+deb12u9 | DSA-5872-1 |
| Debian 12 | xwayland | No fix yet | — |
| Debian 11 | xorg-server | 2:1.20.11-1+deb11u15 | DLA-4072-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | xorg-server | 2:21.1.16-1ubuntu1 | — |
| Ubuntu 24.04 LTS | xorg-server | 2:21.1.12-1ubuntu1.2 | USN-7299-1 |
| Ubuntu 24.04 LTS | xwayland | 2:23.2.6-1ubuntu0.4 | USN-7299-1 |
| Ubuntu 22.04 LTS | xorg-server | 2:21.1.4-2ubuntu1.7~22.04.13 | USN-7299-1 |
| Ubuntu 22.04 LTS | xwayland | 2:22.1.1-1ubuntu0.17 | USN-7299-1 |
| Ubuntu 20.04 LTS | xorg-server | 2:1.20.13-1ubuntu1~20.04.19 | USN-7299-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | xorg-server | 2:1.19.6-1ubuntu4.15+esm12 | USN-7299-4, USN-7299-2 |
| Ubuntu Pro 18.04 LTS | xorg-server-hwe-18.04 | 2:1.20.8-2ubuntu2.2~18.04.11+esm4 | USN-7299-4, USN-7299-2 |
| Ubuntu Pro 16.04 LTS | xorg-server | 2:1.18.4-0ubuntu0.12+esm17 | USN-7299-4, USN-7299-2 |
| Ubuntu Pro 16.04 LTS | xorg-server-hwe-16.04 | 2:1.19.6-1ubuntu4.1~16.04.6+esm9 | USN-7299-4, USN-7299-2 |
| Ubuntu Pro 14.04 LTS | xorg-server | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | xorg-x11-server-Xwayland +1 | 24.1.5-3.el10_0 | RHSA-2025:7458 |
| RHEL 9 | tigervnc +6 | 1.14.1-1.el9_5.1 | RHSA-2025:2500 |
| RHEL 9 | xorg-x11-server +8 | 1.20.11-28.el9_6 | RHSA-2025:7163 |
| RHEL 9 | xorg-x11-server-Xwayland +1 | 23.2.7-3.el9_6 | RHSA-2025:7165 |
| RHEL 8 | tigervnc +6 | 1.13.1-15.el8_10 | RHSA-2025:2502 |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.4 EUS | tigervnc +6 | 1.13.1-8.el9_4.5 | RHSA-2025:2875 |
| RHEL 9.2 EUS | tigervnc +6 | 1.12.0-14.el9_2.10 | RHSA-2025:2874 |
| RHEL 9.0 E4S | tigervnc +6 | 1.11.0-22.el9_0.13 | RHSA-2025:2873 |
| RHEL 8.8 EUS | tigervnc +6 | 1.12.0-15.el8_8.12 | RHSA-2025:2862 |
| RHEL 8.6 TUS | tigervnc +6 | 1.12.0-6.el8_6.13 | RHSA-2025:2880 |
| RHEL 8.6 E4S | tigervnc +6 | 1.12.0-6.el8_6.13 | RHSA-2025:2880 |
| RHEL 8.6 AUS | tigervnc +6 | 1.12.0-6.el8_6.13 | RHSA-2025:2880 |
| RHEL 8.4 TUS | tigervnc +6 | 1.11.0-8.el8_4.12 | RHSA-2025:2865 |
| RHEL 8.4 E4S | tigervnc +6 | 1.11.0-8.el8_4.12 | RHSA-2025:2865 |
| RHEL 8.4 AUS | tigervnc +6 | 1.11.0-8.el8_4.12 | RHSA-2025:2865 |
| RHEL 8.2 AUS | tigervnc +6 | 1.9.0-15.el8_2.13 | RHSA-2025:2866 |
| RHEL 7 ELS | tigervnc +6 | 1.8.0-36.el7_9 | RHSA-2025:2861 |
| RHEL 7 ELS | xorg-x11-server +9 | 1.20.4-30.el7_9 | RHSA-2025:2879 |
| RHEL 6 ELS | tigervnc +3 | 1.1.0-25.el6_10 | RHSA-2025:3976 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | tigervnc +6 | 1.14.1-1.el9_5.1 | ALSA-2025:2500 |
| AlmaLinux 9 | xorg-x11-server-Xdmx +7 | 1.20.11-28.el9_6 | ALSA-2025:7163 |
| AlmaLinux 9 | xorg-x11-server-Xwayland +1 | 23.2.7-3.el9_6 | ALSA-2025:7165 |
| AlmaLinux 8 | tigervnc +6 | 1.13.1-15.el8_10 | ALSA-2025:2502 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | xorg-x11-server-Xwayland | 24.1.5-3.el10_0 | RLSA-2025:7458 |
| Rocky Linux 9 | tigervnc | 1.14.1-1.el9_5.1 | RLSA-2025:2500 |
| Rocky Linux 9 | xorg-x11-server | 1.20.11-28.el9_6 | RLSA-2025:7163 |
| Rocky Linux 9 | xorg-x11-server-Xwayland | 23.2.7-3.el9_6 | RLSA-2025:7165 |
| Rocky Linux 8 | tigervnc | 1.13.1-15.el8_10 | RLSA-2025:2502 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | libxkbfile | 1.0.9-150000.3.3.1 | SUSE-SU-2025:0758-1 |
| SLES 15 SP6 | xorg-x11-server | 1.20.3-150200.22.5.102.1 | SUSE-SU-2025:0733-1, SUSE-SU-2025:0730-1 |
| SLES 15 SP6 | xwayland | 24.1.1-150600.5.9.1 | SUSE-SU-2025:0729-1 |
| SLES 15 SP5 | libxkbfile | 1.0.9-150000.3.3.1 | SUSE-SU-2025:0758-1 |
| SLES 15 SP5 | xorg-x11-server | 21.1.4-150500.7.32.1 | SUSE-SU-2025:0731-1 |
| SLES 15 SP4 | libxkbfile | 1.0.9-150000.3.3.1 | SUSE-SU-2025:0758-1 |
| SLES 15 SP4 | xorg-x11-server | 1.20.3-150400.38.54.1 | SUSE-SU-2025:0732-1 |
| SLES 15 SP3 | libxkbfile | 1.0.9-150000.3.3.1 | SUSE-SU-2025:0758-1 |
| SLES 15 SP3 | xorg-x11-server | 1.20.3-150200.22.5.102.1 | SUSE-SU-2025:0733-1 |
| SLES 12 SP5 | libxkbfile | 1.0.8-12.3.1 | SUSE-SU-2025:0818-1 |
| SLES 12 SP5 | xorg-x11-server | 1.19.6-10.80.1 | SUSE-SU-2025:0734-1 |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP5 | libxkbfile | 1.0.9-150000.3.3.1 | SUSE-SU-2025:0758-1 |
| SLES for SAP 15 SP5 | xorg-x11-server | 21.1.4-150500.7.32.1 | SUSE-SU-2025:0731-1 |
| SLES for SAP 15 SP4 | libxkbfile | 1.0.9-150000.3.3.1 | SUSE-SU-2025:0758-1 |
| SLES for SAP 15 SP4 | xorg-x11-server | 1.20.3-150400.38.54.1 | SUSE-SU-2025:0732-1 |
| SLES for SAP 15 SP3 | libxkbfile | 1.0.9-150000.3.3.1 | SUSE-SU-2025:0758-1 |
| SLES for SAP 15 SP3 | xorg-x11-server | 1.20.3-150200.22.5.102.1 | SUSE-SU-2025:0733-1 |
| SLE HPC 15 SP5 | libxkbfile | 1.0.9-150000.3.3.1 | SUSE-SU-2025:0758-1 |
| SLE HPC 15 SP5 | xorg-x11-server | 21.1.4-150500.7.32.1 | SUSE-SU-2025:0731-1 |
| SLE HPC 15 SP4 | libxkbfile | 1.0.9-150000.3.3.1 | SUSE-SU-2025:0758-1 |
| SLE HPC 15 SP4 | xorg-x11-server | 1.20.3-150400.38.54.1 | SUSE-SU-2025:0732-1 |
| SLE HPC 15 SP3 | libxkbfile | 1.0.9-150000.3.3.1 | SUSE-SU-2025:0758-1 |
| SLE HPC 15 SP3 | xorg-x11-server | 1.20.3-150200.22.5.102.1 | SUSE-SU-2025:0733-1 |
| SUSE Manager Server 4.3 | libxkbfile | 1.0.9-150000.3.3.1 | SUSE-SU-2025:0758-1 |
| SUSE Manager Server 4.3 | xorg-x11-server | 1.20.3-150400.38.54.1 | SUSE-SU-2025:0732-1 |
| SUSE Manager Proxy 4.3 | libxkbfile | 1.0.9-150000.3.3.1 | SUSE-SU-2025:0758-1 |
| SUSE Manager Proxy 4.3 | xorg-x11-server | 1.20.3-150400.38.54.1 | SUSE-SU-2025:0732-1 |
| SUSE Enterprise Storage 7.1 | libxkbfile | 1.0.9-150000.3.3.1 | SUSE-SU-2025:0758-1 |
| SUSE Enterprise Storage 7.1 | xorg-x11-server | 1.20.3-150200.22.5.102.1 | SUSE-SU-2025:0733-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libxkbfile | 1.1.3-2.1 | openSUSE-SU-2025:14838-1 |
| openSUSE Tumbleweed | xorg-x11-server | 21.1.15-2.1 | openSUSE-SU-2025:14841-1 |
| openSUSE Tumbleweed | xwayland | 24.1.5-2.1 | openSUSE-SU-2025:14842-1 |
| openSUSE Leap 15.6 | libxkbfile | 1.0.9-150000.3.3.1 | SUSE-SU-2025:0758-1 |
| openSUSE Leap 15.6 | xorg-x11-server | 21.1.11-150600.5.6.1 | SUSE-SU-2025:0730-1 |
| openSUSE Leap 15.6 | xwayland | 24.1.1-150600.5.9.1 | SUSE-SU-2025:0729-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | xorg-server | 21.1.16-r0 | — |
| Alpine v3.24 | xwayland | 24.1.6-r0 | — |
| Alpine v3.23 | xorg-server | 21.1.16-r0 | — |
| Alpine v3.23 | xwayland | 24.1.6-r0 | — |
| Alpine v3.22 | xorg-server | 21.1.16-r0 | — |
| Alpine v3.22 | xwayland | 24.1.6-r0 | — |
| Alpine v3.21 | xorg-server | 21.1.16-r0 | — |
| Alpine v3.21 | xwayland | 24.1.6-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | xorg-x11-server-Xorg +6 | 21.1.13-5.amzn2023.0.3 | ALAS2023-2025-892 |
| Amazon Linux 2023 | xorg-x11-server-Xwayland +1 | 24.1.3-1.amzn2023.0.1 | ALAS2023-2025-895 |
| Amazon Linux 2 | xorg-x11-server-Xdmx +8 | 1.20.4-22.amzn2.0.8 | ALAS2-2025-2791 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | xorg-x11-server | No fix yet | — |
| Azure Linux 3 | xorg-x11-server-Xwayland | 24.1.6-1 | — |
| Azure Linux 2 (CBL-Mariner) | xorg-x11-server | 1.20.10-15 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | xorg-x11-server-Xwayland +1 | 24.1.5-4.el10_0 | ELSA-2025-7458 |
| Oracle Linux 9 | tigervnc +6 | 1.14.1-1.el9_5.1 | ELSA-2025-2500 |
| Oracle Linux 9 | xorg-x11-server-Xdmx +7 | 1.20.11-28.el9_6 | ELSA-2025-7163 |
| Oracle Linux 9 | xorg-x11-server-Xwayland +1 | 23.2.7-3.el9_6 | ELSA-2025-7165 |
| Oracle Linux 8 | tigervnc +6 | 1.13.1-15.el8_10 | ELSA-2025-2502 |
| Oracle Linux 7 | tigervnc +6 | 1.8.0-33.0.5.el7_9 | ELSA-2025-2861 |
| Oracle Linux 7 | xorg-x11-server-Xdmx +8 | 1.20.4-29.0.1.el7_9 | ELSA-2025-2879 |
Advisories 50
- ALSA-2025:2500 Important: tigervnc security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:7163 Moderate: xorg-x11-server security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:7165 Moderate: xorg-x11-server-Xwayland security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:2502 Important: tigervnc security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2025-0435 X.Org X11: Mehrere Schwachstellen ermöglichen nicht näher spezifizierte Auswirkungen, möglicherweise Codeausführung BSI CERT-Bund (WID) · Sep 21, 2026
- RHSA-2025:7458 Red Hat Security Advisory: xorg-x11-server-Xwayland security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2025:7163 Red Hat Security Advisory: xorg-x11-server security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2025:7165 Red Hat Security Advisory: xorg-x11-server-Xwayland security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2025:3976 Red Hat Security Advisory: tigervnc security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2025:2879 Red Hat Security Advisory: xorg-x11-server security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2025:2880 Red Hat Security Advisory: tigervnc security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2025:2875 Red Hat Security Advisory: tigervnc security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2025:2873 Red Hat Security Advisory: tigervnc security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2025:2874 Red Hat Security Advisory: tigervnc security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2025:2866 Red Hat Security Advisory: tigervnc security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2025:2865 Red Hat Security Advisory: tigervnc security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2025:2862 Red Hat Security Advisory: tigervnc security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2025:2861 Red Hat Security Advisory: tigervnc security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2025:2502 Red Hat Security Advisory: tigervnc security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2025:2500 Red Hat Security Advisory: tigervnc security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- USN-7299-2 xorg-server, xorg-server-hwe-16.04, xorg-server-hwe-18.04 vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- USN-7299-4 xorg-server, xorg-server-hwe-16.04, xorg-server-hwe-18.04 regression Ubuntu Security Notices (USN) · Jun 25, 2026
- USN-7299-1 xorg-server, xwayland vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DSA-5872-1 xorg-server - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-4072-1 xorg-server - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2025:0732-1 Security update for xorg-x11-server SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0818-1 Security update for libxkbfile SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0734-1 Security update for xorg-x11-server SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0731-1 Security update for xorg-x11-server SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0730-1 Security update for xorg-x11-server SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:14841-1 xorg-x11-server-21.1.15-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0758-1 Security update for libxkbfile SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:14842-1 xwayland-24.1.5-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0729-1 Security update for xwayland SUSE / openSUSE Security Updates · Feb 4, 2026
- RLSA-2025:7458 Important: xorg-x11-server-Xwayland security update Rocky Linux Security Advisories · Oct 8, 2025
- RLSA-2025:7165 Moderate: xorg-x11-server-Xwayland security update Rocky Linux Security Advisories · Oct 7, 2025
- RLSA-2025:7163 Moderate: xorg-x11-server security update Rocky Linux Security Advisories · Oct 4, 2025
- ELSA-2025-7458 Important: xorg-x11-server-Xwayland security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 7, 2025
- ELSA-2025-7165 Moderate: xorg-x11-server-Xwayland security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 16, 2025
- ELSA-2025-7163 Moderate: xorg-x11-server security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 16, 2025
- RLSA-2025:2500 Important: tigervnc security update Rocky Linux Security Advisories · May 7, 2025
- RLSA-2025:2502 Important: tigervnc security update Rocky Linux Security Advisories · May 7, 2025
- openSUSE-SU-2025:14838-1 libxkbfile-devel-1.1.3-2.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- SUSE-SU-2025:0733-1 Security update for xorg-x11-server SUSE / openSUSE Security Updates · May 2, 2025
- ELSA-2025-2879 Important: xorg-x11-server security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Apr 7, 2025
- ELSA-2025-2861 Important: tigervnc security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Mar 31, 2025
- ALAS2023-2025-892 Important: xorg-x11-server security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Mar 26, 2025
- ALAS2023-2025-895 Important: xorg-x11-server-Xwayland security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Mar 26, 2025
- ALAS2-2025-2791 Important: xorg-x11-server security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Mar 25, 2025
- ELSA-2025-2500 Important: tigervnc security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Mar 10, 2025
References
- RHSA-2025:2500 vendor-advisory
- RHSA-2025:2502 vendor-advisory
- RHSA-2025:2861 vendor-advisory
- RHSA-2025:2862 vendor-advisory
- RHSA-2025:2865 vendor-advisory
- RHSA-2025:2866 vendor-advisory
- RHSA-2025:2873 vendor-advisory
- RHSA-2025:2874 vendor-advisory
- RHSA-2025:2875 vendor-advisory
- RHSA-2025:2879 vendor-advisory
- RHSA-2025:2880 vendor-advisory
- RHSA-2025:3976 vendor-advisory
- RHSA-2025:7163 vendor-advisory
- RHSA-2025:7165 vendor-advisory
- RHSA-2025:7458 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-26595 vdb-entry
- RHBZ#2345257 issue-tracking