CVE-2025-26596: Xorg: xwayland: heap overflow in xkbwritekeysyms()
Description
A heap overflow flaw was found in X.Org and Xwayland. The computation of the length in XkbSizeKeySyms() differs from what is written in XkbWriteKeySyms(), which may lead to a heap-based buffer overflow.
Classification
CVE ID: CVE-2025-26596
Problem Types
Heap-based Buffer OverflowAffected Products
Vendor: Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
Product: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.02% (probability of being exploited)
EPSS Percentile: 3.54% (scored less or equal to compared to others)
EPSS Date: 2025-03-26 (when was this score calculated)
References
https://nvd.nist.gov/vuln/detail/CVE-2025-26596https://access.redhat.com/security/cve/CVE-2025-26596
https://bugzilla.redhat.com/show_bug.cgi?id=2345256