A use-after-free flaw was found in the X.Org X server and Xwayland in FreeCounter(). A client that sets up multiple SyncCounters and awaits on those triggers can trigger a use-after-free when destroying those counters via a second client connection. This may be used to crash the server, or for privilege escalation if the X server runs as root.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade xorg-x11-server-XephyrUpgrade tigervnc-server-minimalUpgrade xorg-x11-server-sourceUpgrade tigervncUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-develUpgrade tigervnc-server-moduleUpgrade xorg-x11-server-XdmxUpgrade tigervnc-serverUpgrade tigervnc-selinuxUpgrade xorg-x11-server-XnestUpgrade tigervnc-iconsUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-Xwayland-develUpgrade xorg-x11-server-commonUpgrade tigervnc-licenseUpgrade xorg-x11-server-Xwayland | Jun 17, 2026 | Jun 17, 2026 |
| Amazon Linux Ami 2 | — | Upgrade xorg-x11-server-develUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-Xwayland | Jun 16, 2026 | Jun 16, 2026 |
| Amazon_linux_2023 | — | Upgrade xorg-x11-server-XnestUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-debuginfoUpgrade tigervnc-server-debuginfoUpgrade tigervnc-serverUpgrade tigervnc-debugsourceUpgrade xorg-x11-server-Xwayland-debugsourceUpgrade xorg-x11-server-Xorg-debuginfoUpgrade tigervnc-server-minimalUpgrade xorg-x11-server-debugsourceUpgrade xorg-x11-server-Xwayland-develUpgrade xorg-x11-server-Xwayland-debuginfoUpgrade tigervnc-debuginfoUpgrade tigervnc-server-minimal-debuginfoUpgrade tigervnc-selinuxUpgrade xorg-x11-server-XephyrUpgrade tigervnc-server-module-debuginfoUpgrade tigervncUpgrade tigervnc-licenseUpgrade tigervnc-iconsUpgrade xorg-x11-server-Xephyr-debuginfoUpgrade tigervnc-server-moduleUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-Xnest-debuginfoUpgrade xorg-x11-server-develUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-Xvfb-debuginfoUpgrade xorg-x11-server-source | Jun 23, 2026 | Jun 5, 2026 |
| Debian | — | Upgrade xorg-server | Jul 23, 2026 | Jul 23, 2026 |
| Freebsd | — | Upgrade xorg-serverUpgrade xwayland | Jun 15, 2026 | Jun 1, 2026 |
| Gentoo Linux | — | Upgrade x11-base/xorg-server.Upgrade x11-base/xwayland. | Aug 17, 2026 | Aug 17, 2026 |
| Redhat_linux | — | Upgrade xorg-x11-server-Xnest-debuginfoUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-Xorg-debuginfoUpgrade tigervnc-debugsourceUpgrade xorg-x11-server-Xwayland-develUpgrade xorg-x11-server-debugsourceUpgrade tigervnc-server-minimalUpgrade tigervnc-serverUpgrade tigervnc-server-moduleUpgrade xorg-x11-server-Xwayland-debuginfoUpgrade xorg-x11-server-XwaylandUpgrade tigervnc-server-minimal-debuginfoUpgrade tigervnc-server-appletUpgrade xorg-x11-server-debuginfoUpgrade tigervnc-server-module-debuginfoUpgrade tigervnc-iconsUpgrade tigervnc-selinuxUpgrade tigervnc-licenseUpgrade xorg-x11-server-develUpgrade tigervncUpgrade tigervnc-server-debuginfoNo solution existsUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-Xephyr-debuginfoUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-Xwayland-debugsourceUpgrade tigervnc-debuginfoUpgrade xorg-x11-server-Xdmx-debuginfoUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-Xvfb-debuginfoUpgrade xorg-x11-server-Xephyr | Jun 19, 2026 | Jun 2, 2026 |
| Rocky_linux | — | Upgrade xorg-x11-server-XdmxUpgrade tigervnc-server-debuginfoUpgrade xorg-x11-server-Xwayland-debugsourceUpgrade tigervnc-serverUpgrade xorg-x11-server-Xnest-debuginfoUpgrade tigervncUpgrade tigervnc-debuginfoUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-Xvfb-debuginfoUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-XephyrUpgrade tigervnc-server-minimal-debuginfoUpgrade xorg-x11-server-develUpgrade xorg-x11-server-Xephyr-debuginfoUpgrade tigervnc-server-moduleUpgrade tigervnc-server-module-debuginfoUpgrade xorg-x11-server-XorgUpgrade tigervnc-server-minimalUpgrade xorg-x11-server-Xwayland-debuginfoUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-Xwayland-develUpgrade tigervnc-debugsourceUpgrade xorg-x11-server-debugsourceUpgrade xorg-x11-server-Xdmx-debuginfoUpgrade xorg-x11-server-Xorg-debuginfo | Jun 22, 2026 | Jun 19, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub