Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-41cd-s77z-6bcc
Vulnerability ID VCID-41cd-s77z-6bcc
Aliases CVE-2025-26596
Summary A vulnerability has been discovered in the Xorg Server and XWayland, the worst of which can result in privilege escalation.
Status Published
Exploitability 0.5
Weighted Severity 7.0
Risk 3.5
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-787 Out-of-bounds Write
System Score Found at
cvssv3.1 7.8 https://access.redhat.com/errata/RHSA-2025:2500
ssvc Track https://access.redhat.com/errata/RHSA-2025:2500
cvssv3.1 7.8 https://access.redhat.com/errata/RHSA-2025:2502
ssvc Track https://access.redhat.com/errata/RHSA-2025:2502
cvssv3.1 7.8 https://access.redhat.com/errata/RHSA-2025:2861
ssvc Track https://access.redhat.com/errata/RHSA-2025:2861
cvssv3.1 7.8 https://access.redhat.com/errata/RHSA-2025:2862
ssvc Track https://access.redhat.com/errata/RHSA-2025:2862
cvssv3.1 7.8 https://access.redhat.com/errata/RHSA-2025:2865
ssvc Track https://access.redhat.com/errata/RHSA-2025:2865
cvssv3.1 7.8 https://access.redhat.com/errata/RHSA-2025:2866
ssvc Track https://access.redhat.com/errata/RHSA-2025:2866
cvssv3.1 7.8 https://access.redhat.com/errata/RHSA-2025:2873
ssvc Track https://access.redhat.com/errata/RHSA-2025:2873
cvssv3.1 7.8 https://access.redhat.com/errata/RHSA-2025:2874
ssvc Track https://access.redhat.com/errata/RHSA-2025:2874
cvssv3.1 7.8 https://access.redhat.com/errata/RHSA-2025:2875
ssvc Track https://access.redhat.com/errata/RHSA-2025:2875
cvssv3.1 7.8 https://access.redhat.com/errata/RHSA-2025:2879
ssvc Track https://access.redhat.com/errata/RHSA-2025:2879
cvssv3.1 7.8 https://access.redhat.com/errata/RHSA-2025:2880
ssvc Track https://access.redhat.com/errata/RHSA-2025:2880
cvssv3.1 7.8 https://access.redhat.com/errata/RHSA-2025:3976
ssvc Track https://access.redhat.com/errata/RHSA-2025:3976
cvssv3.1 7.8 https://access.redhat.com/errata/RHSA-2025:7163
ssvc Track https://access.redhat.com/errata/RHSA-2025:7163
cvssv3.1 7.8 https://access.redhat.com/errata/RHSA-2025:7165
ssvc Track https://access.redhat.com/errata/RHSA-2025:7165
cvssv3.1 7.8 https://access.redhat.com/errata/RHSA-2025:7458
ssvc Track https://access.redhat.com/errata/RHSA-2025:7458
cvssv3 7.8 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-26596.json
cvssv3.1 7.8 https://access.redhat.com/security/cve/CVE-2025-26596
ssvc Track https://access.redhat.com/security/cve/CVE-2025-26596
epss 0.00021 https://api.first.org/data/v1/epss?cve=CVE-2025-26596
epss 0.00021 https://api.first.org/data/v1/epss?cve=CVE-2025-26596
epss 0.00021 https://api.first.org/data/v1/epss?cve=CVE-2025-26596
epss 0.00021 https://api.first.org/data/v1/epss?cve=CVE-2025-26596
epss 0.00021 https://api.first.org/data/v1/epss?cve=CVE-2025-26596
epss 0.00021 https://api.first.org/data/v1/epss?cve=CVE-2025-26596
epss 0.00058 https://api.first.org/data/v1/epss?cve=CVE-2025-26596
epss 0.00058 https://api.first.org/data/v1/epss?cve=CVE-2025-26596
cvssv3.1 7.8 https://bugzilla.redhat.com/show_bug.cgi?id=2345256
ssvc Track https://bugzilla.redhat.com/show_bug.cgi?id=2345256
cvssv3.1 5.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-26596.json
https://api.first.org/data/v1/epss?cve=CVE-2025-26596
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26596
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
1098906 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1098906
1098907 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1098907
2345256 https://bugzilla.redhat.com/show_bug.cgi?id=2345256
cpe:/a:redhat:enterprise_linux:8::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:enterprise_linux:8::appstream
cpe:/a:redhat:enterprise_linux:9::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/a:redhat:enterprise_linux:9::crb https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:enterprise_linux:9::crb
cpe:/a:redhat:rhel_aus:8.2::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:rhel_aus:8.2::appstream
cpe:/a:redhat:rhel_aus:8.4::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:rhel_aus:8.4::appstream
cpe:/a:redhat:rhel_aus:8.6::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:rhel_aus:8.6::appstream
cpe:/a:redhat:rhel_e4s:8.4::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:rhel_e4s:8.4::appstream
cpe:/a:redhat:rhel_e4s:8.6::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:rhel_e4s:8.6::appstream
cpe:/a:redhat:rhel_e4s:9.0::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:rhel_e4s:9.0::appstream
cpe:/a:redhat:rhel_eus:8.8::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:rhel_eus:8.8::appstream
cpe:/a:redhat:rhel_eus:9.2::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:rhel_eus:9.2::appstream
cpe:/a:redhat:rhel_eus:9.4::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:rhel_eus:9.4::appstream
cpe:/a:redhat:rhel_tus:8.4::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:rhel_tus:8.4::appstream
cpe:/a:redhat:rhel_tus:8.6::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:rhel_tus:8.6::appstream
cpe:/o:redhat:enterprise_linux:10.0 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:10.0
cpe:/o:redhat:enterprise_linux:6 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:8 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:rhel_els:6 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:rhel_els:6
cpe:/o:redhat:rhel_els:7 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:rhel_els:7
CVE-2025-26596 https://access.redhat.com/security/cve/CVE-2025-26596
GLSA-202506-04 https://security.gentoo.org/glsa/202506-04
RHSA-2025:2500 https://access.redhat.com/errata/RHSA-2025:2500
RHSA-2025:2502 https://access.redhat.com/errata/RHSA-2025:2502
RHSA-2025:2861 https://access.redhat.com/errata/RHSA-2025:2861
RHSA-2025:2862 https://access.redhat.com/errata/RHSA-2025:2862
RHSA-2025:2865 https://access.redhat.com/errata/RHSA-2025:2865
RHSA-2025:2866 https://access.redhat.com/errata/RHSA-2025:2866
RHSA-2025:2873 https://access.redhat.com/errata/RHSA-2025:2873
RHSA-2025:2874 https://access.redhat.com/errata/RHSA-2025:2874
RHSA-2025:2875 https://access.redhat.com/errata/RHSA-2025:2875
RHSA-2025:2879 https://access.redhat.com/errata/RHSA-2025:2879
RHSA-2025:2880 https://access.redhat.com/errata/RHSA-2025:2880
RHSA-2025:3976 https://access.redhat.com/errata/RHSA-2025:3976
RHSA-2025:7163 https://access.redhat.com/errata/RHSA-2025:7163
RHSA-2025:7165 https://access.redhat.com/errata/RHSA-2025:7165
RHSA-2025:7458 https://access.redhat.com/errata/RHSA-2025:7458
USN-7299-1 https://usn.ubuntu.com/7299-1/
USN-7299-2 https://usn.ubuntu.com/7299-2/
USN-7299-4 https://usn.ubuntu.com/7299-4/
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2025:2500
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-02-25T17:14:01Z/ Found at https://access.redhat.com/errata/RHSA-2025:2500
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2025:2502
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-02-25T17:14:01Z/ Found at https://access.redhat.com/errata/RHSA-2025:2502
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2025:2861
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-02-25T17:14:01Z/ Found at https://access.redhat.com/errata/RHSA-2025:2861
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2025:2862
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-02-25T17:14:01Z/ Found at https://access.redhat.com/errata/RHSA-2025:2862
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2025:2865
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-02-25T17:14:01Z/ Found at https://access.redhat.com/errata/RHSA-2025:2865
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2025:2866
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-02-25T17:14:01Z/ Found at https://access.redhat.com/errata/RHSA-2025:2866
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2025:2873
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-02-25T17:14:01Z/ Found at https://access.redhat.com/errata/RHSA-2025:2873
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2025:2874
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-02-25T17:14:01Z/ Found at https://access.redhat.com/errata/RHSA-2025:2874
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2025:2875
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-02-25T17:14:01Z/ Found at https://access.redhat.com/errata/RHSA-2025:2875
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2025:2879
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-02-25T17:14:01Z/ Found at https://access.redhat.com/errata/RHSA-2025:2879
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2025:2880
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-02-25T17:14:01Z/ Found at https://access.redhat.com/errata/RHSA-2025:2880
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2025:3976
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-02-25T17:14:01Z/ Found at https://access.redhat.com/errata/RHSA-2025:3976
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2025:7163
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-02-25T17:14:01Z/ Found at https://access.redhat.com/errata/RHSA-2025:7163
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2025:7165
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-02-25T17:14:01Z/ Found at https://access.redhat.com/errata/RHSA-2025:7165
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2025:7458
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-02-25T17:14:01Z/ Found at https://access.redhat.com/errata/RHSA-2025:7458
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-26596.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/security/cve/CVE-2025-26596
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-02-25T17:14:01Z/ Found at https://access.redhat.com/security/cve/CVE-2025-26596
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://bugzilla.redhat.com/show_bug.cgi?id=2345256
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-02-25T17:14:01Z/ Found at https://bugzilla.redhat.com/show_bug.cgi?id=2345256
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.05731
EPSS Score 0.00021
Published At April 7, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:11:53.159694+00:00 Gentoo Importer Import https://security.gentoo.org/glsa/202506-04 38.0.0