CVE-2025-26597
Published: 25 February 2025
Summary
CVE-2025-26597 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Redhat Enterprise Linux. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation of Remote Services (T1210); ranked at the 8.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Mandates timely remediation of identified software flaws, such as applying Red Hat patches for the buffer overflow in X.Org and Xwayland.
Implements memory safeguards like ASLR, DEP, and stack canaries to block unauthorized code execution from buffer overflows in functions like XkbChangeTypesOfKey.
Requires validation of inputs to prevent improper operations like resizing key tables to zero groups that mismatch key actions sizes.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow and related memory corruption vulnerabilities (e.g., use-after-free, heap overflow) in Xwayland, as used in TigerVNC remote display system, enable remote code execution via exploitation of the remote service.
NVD Description
A buffer overflow flaw was found in X.Org and Xwayland. If XkbChangeTypesOfKey() is called with a 0 group, it will resize the key symbols table to 0 but leave the key actions unchanged. If the same function is later called…
more
with a non-zero value of groups, this will cause a buffer overflow because the key actions are of the wrong size.
Deeper analysisAI
CVE-2025-26597 is a buffer overflow vulnerability in X.Org and Xwayland. The flaw occurs in the XkbChangeTypesOfKey() function: when called with a group value of 0, it resizes the key symbols table to zero while leaving the key actions unchanged. A subsequent call with a non-zero group value then triggers a buffer overflow due to the mismatched size of the key actions table. This issue, classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), received a CVSS v3.1 base score of 7.8.
The vulnerability can be exploited by a local attacker with low privileges (PR:L). It requires local access (AV:L) and low attack complexity (AC:L) with no user interaction (UI:N), allowing the attacker to achieve high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) within the affected system's scope (S:U). Successful exploitation could enable arbitrary code execution or system compromise from a low-privileged context.
Red Hat has addressed the vulnerability through multiple errata releases, including RHSA-2025:2500, RHSA-2025:2502, RHSA-2025:2861, RHSA-2025:2862, and RHSA-2025:2865, which provide updated packages for affected X.Org and Xwayland components in various Red Hat Enterprise Linux versions. Security practitioners should apply these patches promptly to mitigate the risk.
Details
- CWE(s)