CVE-2025-62229
High · 7.3CVSS
7.3
EPSS
0.5%
Published
Oct 30, 2025
CISA due date
—
The record
A flaw was found in the X.Org X server and Xwayland when processing X11 Present extension notifications. Improper error handling during notification creation can leave dangling pointers that lead to a use-after-free condition. This can cause memory corruption or a crash, potentially allowing an attacker to execute arbitrary code or cause a denial of service.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Mageia:9 | tigervnc | 0 | 1.13.1-2.9.mga9 |
| Mageia:9 | x11-server | 0 | 21.1.8-7.9.mga9 |
| Mageia:9 | x11-server-xwayland | 0 | 22.1.9-1.9.mga9 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | xorg-x11-server | 0 | 21.1.11-150600.5.20.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | xorg-x11-server | 0 | 21.1.11-150600.5.20.1 |
| SUSE:Linux Enterprise Workstation Extension 15 SP6 | xwayland | 0 | 24.1.1-150600.5.18.1 |
| openSUSE:Leap 15.6 | xorg-x11-server | 0 | 21.1.11-150600.5.20.1 |
| openSUSE:Leap 15.6 | xwayland | 0 | 24.1.1-150600.5.18.1 |
| openSUSE:Leap 16.0 | xorg-x11-server | 0 | 21.1.15-160000.3.1 |
| openSUSE:Leap 16.0 | xwayland | 0 | 24.1.6-160000.3.1 |
| openSUSE:Tumbleweed | xorg-x11-server | 0 | 21.1.15-7.1 |
| openSUSE:Tumbleweed | xwayland | 0 | 24.1.8-4.1 |
Related vulnerabilities
- CVE-2025-62230 A flaw was discovered in the X.Org X server’s X Keyboard (Xkb) extension when handling… Also affects tigervnc
- CVE-2025-62231 A flaw was identified in the X.Org X server’s X Keyboard (Xkb) extension where improper… Also affects tigervnc
- CVE-2024-9632 A flaw was found in the X.org server. Also affects tigervnc
- CVE-2024-31083 A use-after-free vulnerability was found in the ProcRenderAddGlyphs() function of Xorg… Also affects tigervnc
- CVE-2024-31081 A heap-based buffer over-read vulnerability was found in the X.org server's… Also affects tigervnc
- CVE-2024-31080 A heap-based buffer over-read vulnerability was found in the X.org server's… Also affects tigervnc
- CVE-2024-21886 A heap buffer overflow flaw was found in the DisableDevice function in the X.Org server. Also affects tigervnc
- CVE-2024-21885 A flaw was found in X.Org server. Also affects tigervnc