High
Xorg: xwayland: buffer overflow in xkbvmodmasktext()
Type: advisorySources: OSV
A buffer overflow flaw was found in X.Org and Xwayland. The code in XkbVModMaskText() allocates a fixed-sized buffer on the stack and copies the names of the virtual modifiers to that buffer. The code fails to check the bounds of the buffer and would copy the data regardless of the size.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2025-26595
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 5 Nov 2026, 23:51 UTC · Revision 1
Source evidence
Xorg: xwayland: buffer overflow in xkbvmodmasktext()
core-osv · Original sourcePublished 25 Feb 2025, 15:54 UTC
A buffer overflow flaw was found in X.Org and Xwayland. The code in XkbVModMaskText() allocates a fixed-sized buffer on the stack and copies the names of the virtual modifiers to that buffer. The code fails to check the bounds of the buffer and would copy the data regardless of the size.
osv:CVE-2025-26595
Complete source record
{
"id": "2a01f82a9196c9c9f4e76d6c59736bd29667d319d9f450b946290e6d80aad9db",
"url": "https://osv.dev/vulnerability/CVE-2025-26595",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Xorg: xwayland: buffer overflow in xkbvmodmasktext()",
"summary": "A buffer overflow flaw was found in X.Org and Xwayland. The code in XkbVModMaskText() allocates a fixed-sized buffer on the stack and copies the names of the virtual modifiers to that buffer. The code fails to check the bounds of the buffer and would copy the data regardless of the size.",
"evidence": "osv:CVE-2025-26595",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2025-26595",
"aliases": [
"CVE-2025-26595"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://gitlab.freedesktop.org/xorg/xserver",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "b7f84e6d509c004a7abb514af75b94cb907d451b"
},
{
"fixed": "5b1d9da00f217d3b52bfd3cc862dff79a9433e63"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "21.1.16"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"introduced": "22.0.0"
},
{
"fixed": "24.1.6"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
}
}
],
"versions": [
"xwayland-24.1.5",
"xorg-server-21.1.15",
"xwayland-24.1.4",
"xorg-server-21.1.14",
"xwayland-24.1.3",
"xwayland-24.1.2",
"xwayland-24.1.1",
"xwayland-24.1.0",
"xwayland-24.0.99.902",
"xorg-server-21.1.13",
"xwayland-24.0.99.901",
"xorg-server-21.1.12",
"xorg-server-21.1.11",
"xorg-server-21.1.10",
"xorg-server-21.1.9",
"xorg-server-21.1.8",
"xorg-server-21.1.7",
"xorg-server-21.1.6",
"xorg-server-21.1.5",
"xorg-server-21.1.4",
"xorg-server-21.1.3",
"xorg-server-21.1.2",
"xorg-server-21.1.1",
"xorg-server-21.1.0",
"xorg-server-21.0.99.902",
"xorg-server-21.0.99.901",
"xorg-server-21.0.99.1",
"xorg-server-1.20.0",
"xorg-server-1.19.99.905",
"xorg-server-1.19.99.904",
"xorg-server-1.19.99.903",
"xorg-server-1.19.99.902",
"xorg-server-1.19.99.901",
"xorg-server-1.19.0",
"xorg-server-1.18.99.902",
"xorg-server-1.18.99.901",
"xorg-server-1.18.99.2",
"xorg-server-1.18.0",
"xorg-server-1.17.99.902",
"xorg-server-1.17.99.901",
"xorg-server-1.17.0",
"xorg-server-1.16.99.902",
"xorg-server-1.16.99.901",
"xorg-server-1.16.0",
"xorg-server-1.15.99.904",
"xorg-server-1.15.99.903",
"xorg-server-1.15.99.902",
"xorg-server-1.15.99.901",
"xorg-server-1.15.0",
"xorg-server-1.14.99.905",
"xorg-server-1.14.99.904",
"xorg-server-1.14.99.903",
"xorg-server-1.14.99.902",
"xorg-server-1.14.99.901",
"xorg-server-1.14.99.3",
"xorg-server-1.14.99.2",
"xorg-server-1.14.99.1",
"xorg-server-1.14.0",
"xorg-server-1.13.99.902",
"xorg-server-1.13.99.901",
"xorg-server-1.13.0",
"xorg-server-1.12.99.905",
"xorg-server-1.12.99.904",
"xorg-server-1.12.99.903",
"xorg-server-1.12.99.902",
"xorg-server-1.12.99.901",
"xorg-server-1.12.0",
"xorg-server-1.11.99.903",
"xorg-server-1.11.99.902",
"xorg-server-1.11.99.901",
"xorg-server-1.11.99.1",
"xorg-server-1.11.0",
"xorg-server-1.10.99.902",
"xorg-server-1.10.99.901",
"xorg-server-1.10.0",
"xorg-server-1.9.99.903",
"xorg-server-1.9.99.902",
"xorg-server-1.9.99.901",
"xorg-server-1.9.0",
"xorg-server-1.8.99.906",
"xorg-server-1.8.99.905",
"xorg-server-1.8.99.904",
"xorg-server-1.8.99.903",
"xorg-server-1.8.99.902",
"xorg-server-1.8.99.901",
"xorg-server-1.8.0",
"xorg-server-1.7.99.902",
"xorg-server-1.7.99.901",
"xorg-server-1.7.99.2",
"xorg-server-1.7.99.1",
"xorg-server-1.6.99.901",
"xorg-server-1.6.99.900",
"xorg-server-1.5.99.1",
"xorg-server-1.1.99.3",
"xorg-server-1_1_99_2",
"xorg-server-1_0_99_901",
"XORG-7_0_99_901",
"xorg-server-1_1_99_1",
"xorg-server-1_0_99_2",
"xorg-server-1_0_99_1",
"XORG-7_0",
"pre-xgldrop-merge",
"XORG-6_99_99_904",
"MODULAR_COPY",
"XORG-6_99_99_903",
"XORG-6_8_99_903",
"DRM-2_0_0",
"XORG-6_99_99_902",
"XORG-6_8_99_902",
"DRM-1_0_5",
"XORG-6_99_99_901",
"XORG-6_8_99_901",
"DRM-20051017",
"kdrive-initial-import",
"xorg-server-0_99_1",
"XORG-6_99_99_900",
"XORG-6_8_99_900",
"XORG-6_8_99_16",
"XORG-6_8_99_15",
"XORG-6_8_99_14",
"XORG-6_8_99_13",
"XORG-6_8_99_12",
"DRM-20050615",
"sco_port_update-base",
"XORG-6_8_99_11",
"XORG-6_8_99_10",
"XORG-6_8_99_9",
"XORG-6_8_99_8",
"XORG-6_8_99_7",
"XORG-6_8_99_6",
"XORG-6_8_99_5",
"XORG-6_8_99_4",
"XORG-6_8_99_3",
"XORG-6_8_99_2",
"XORG-6_8_99_1",
"lg3d-base",
"XORG-6_8_0",
"XORG-6_7_99_904",
"XORG-6_7_99_903",
"XORG-6_7_99_902",
"XORG-6_7_99_901",
"XORG-6_7_99_2",
"XORG-6_7_99_1",
"DRM-20040721",
"DRI-trunk-20040721",
"DRI-trunk-20040613",
"DRI-XFree86-4_3_99_12-merge",
"DRM-20040613",
"XACE-SELINUX-MERGE",
"xf86-4_4_99_1",
"xf86-4_4_0",
"xf86-4_3_99_903",
"xf86-4_3_99_903_special",
"add-Xi",
"xf86-012804-2330",
"xf86-4_3_99_902",
"xf86-4_3_99_901",
"dri-0-1-branchpoint",
"xf86-4_3_99_16",
"xf86-4_3_0_1",
"PRE_xf86-4_3_0_1",
"XORG-MAIN",
"xfixes_2_branchpoint",
"keithp",
"xf-4_3_99_6",
"xf-4_3_99_5",
"xf-4_3_99_4",
"xf-4_3_99_3",
"xf-4_3_99_2",
"xf-4_3_99_1",
"xf-4_3_0_1",
"xf-4_3_0",
"xf-4_2_99_902",
"xf-4_2_99_901",
"xf-4_2_99_4",
"xf-4_2_99_3",
"ah-20021030-postdri",
"xf-4_2_99_2",
"ah-20021030",
"dhd-20020916",
"xf-4_2_99_1",
"dri-20020222-merge",
"before-mesa-4_0-import",
"dri-20020129-merge",
"xf-4_2_1_1",
"xf-4_2_1",
"xf-4_2_0_1",
"xf-4_2_0-bindist-1",
"xf-4_2_0-bindist",
"xf-4_2_0",
"xf-4_2-bp",
"xf-4_1_99_7",
"xf-4_1_99_6",
"xf-4_1_99_5",
"xf-4_1_99_4",
"Domain-sync4",
"Domain-sync3",
"xf-4_1_99_3",
"xf-4_1_99_2",
"Domain-sync2",
"Domain-sync1",
"Domain-base",
"xf-4_1_99_1",
"dhd-20010817",
"xf-4_0_99_900",
"xf-4_0_99_3",
"xf-4_0_99_2",
"dhd-20010328",
"xf-4_0_99_1",
"xf-4_0_2-bindist",
"xf-4_0_2",
"xf-4_0_1Zc",
"xf-4_0_1Zb",
"pre-R651-import",
"xf-4_0_1Za",
"xf-4_0_1Z",
"xf-4_0_1h",
"xf-4_0_1g",
"xf-4_0_1f",
"xf-4_0_1e",
"xf-4_0_1d",
"xf-4_0_1c",
"xf-4_0_1b",
"xf-4_0g",
"xf-4_0f",
"xf-4_0e",
"xf-4_0d",
"xf-4_0c",
"xf-4_0_1a",
"xf-4_0_1-bindist",
"xf-4_0_1",
"xf-4_0Z",
"xf-4_0b",
"xf-4_0a",
"xf-4_0-bindist",
"xf-4_0",
"xf-3_9_18b",
"xf-3_9_18a",
"xf-3_9_18Za",
"xf-3_9_18Z",
"xf-3_9_18",
"xf-3_9_17f",
"xf-3_9_17e",
"xf-3_9_17d",
"xf-3_9_17c",
"xf-3_9_17b",
"xf-3_9_17a",
"xf-3_9_17Z",
"xf-3_9_17",
"xf-3_9_16Za",
"xf-3_9_16f",
"xf-3_9_16e",
"xf-3_9_16d",
"xf-3_9_16Z"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-26595.json"
}
}
],
"modified": "2026-10-28T02:30:45.317590752Z",
"provider": "osv",
"references": [
"https://access.redhat.com/downloads/content/package-browser/",
"https://lists.debian.org/debian-lts-announce/2025/02/msg00036.html",
"https://access.redhat.com/errata/RHSA-2025:2500",
"https://access.redhat.com/errata/RHSA-2025:2502",
"https://access.redhat.com/errata/RHSA-2025:2861",
"https://access.redhat.com/errata/RHSA-2025:2862",
"https://access.redhat.com/errata/RHSA-2025:2865",
"https://access.redhat.com/errata/RHSA-2025:2866",
"https://access.redhat.com/errata/RHSA-2025:2873",
"https://access.redhat.com/errata/RHSA-2025:2874",
"https://access.redhat.com/errata/RHSA-2025:2875",
"https://access.redhat.com/errata/RHSA-2025:2879",
"https://access.redhat.com/errata/RHSA-2025:2880",
"https://access.redhat.com/errata/RHSA-2025:3976",
"https://access.redhat.com/errata/RHSA-2025:7163",
"https://access.redhat.com/errata/RHSA-2025:7165",
"https://access.redhat.com/errata/RHSA-2025:7458",
"https://access.redhat.com/security/cve/CVE-2025-26595",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/26xxx/CVE-2025-26595.json",
"https://nvd.nist.gov/vuln/detail/CVE-2025-26595",
"https://bugzilla.redhat.com/show_bug.cgi?id=2345257",
"https://gitlab.freedesktop.org/xorg/xserver/"
],
"provider_metadata": {
"cwe_ids": [
"CWE-121"
],
"cna_assigner": "redhat",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"fixed": "0:24.1.5-3.el10_0"
},
{
"fixed": "0:1.1.0-25.el6_10"
},
{
"fixed": "0:1.8.0-36.el7_9"
},
{
"fixed": "0:1.20.4-30.el7_9"
},
{
"fixed": "0:1.13.1-15.el8_10"
},
{
"fixed": "0:1.9.0-15.el8_2.13"
},
{
"fixed": "0:1.11.0-8.el8_4.12"
},
{
"fixed": "0:1.11.0-8.el8_4.12"
},
{
"fixed": "0:1.11.0-8.el8_4.12"
},
{
"fixed": "0:1.12.0-6.el8_6.13"
},
{
"fixed": "0:1.12.0-6.el8_6.13"
},
{
"fixed": "0:1.12.0-6.el8_6.13"
},
{
"fixed": "0:1.12.0-15.el8_8.12"
},
{
"fixed": "0:1.14.1-1.el9_5.1"
},
{
"fixed": "0:1.20.11-28.el9_6"
},
{
"fixed": "0:23.2.7-3.el9_6"
},
{
"fixed": "0:1.11.0-22.el9_0.13"
},
{
"fixed": "0:1.12.0-14.el9_2.10"
},
{
"fixed": "0:1.13.1-8.el9_4.5"
}
],
"source": "AFFECTED_FIELD",
"strategy": "InverseAffectedRanges"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/26xxx/CVE-2025-26595.json"
}
},
"related_cves": [
{
"value": "CVE-2025-26595",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 513225,
"published_at": "2025-02-25T15:54:06.708+00:00"
}