Skip to main content

Severity by source

Vendor (redhat) PRIMARY
7.3 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
SUSE
HIGH
qualitative
Red Hat
7.3 MEDIUM
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
High

Lifecycle Timeline

1
Analysis Generated
Apr 20, 2026 - 14:34 vuln.today

DescriptionCVE.org

A flaw was discovered in the X.Org X server’s X Keyboard (Xkb) extension when handling client resource cleanup. The software frees certain data structures without properly detaching related resources, leading to a use-after-free condition. This can cause memory corruption or a crash when affected clients disconnect.

AnalysisAI

Use-after-free memory corruption in X.Org X server's Xkb extension allows local authenticated attackers to achieve high confidentiality impact, low integrity impact, and high availability impact (CVSS 7.3) through improper resource cleanup during client disconnection. The vulnerability affects Red Hat Enterprise Linux distributions with multiple security advisories released (RHSA-2025:19432 through RHSA-2025:22055). EPSS data not provided, but the local attack vector (AV:L) and low complexity (AC:L) indicate exploitation requires authenticated local access. No CISA KEV listing or public POC identified at time of analysis.

Technical ContextAI

The X.Org X server implements the X Keyboard (Xkb) extension to manage keyboard mappings, layouts, and input device configuration in X11 windowing systems. This vulnerability (CWE-416: Use After Free) occurs in the resource cleanup path when X11 clients disconnect from the server. The software incorrectly frees memory structures containing Xkb-related data without properly detaching or nullifying pointers held by related resources. When subsequent code attempts to access these freed memory regions-either through lingering references or during final cleanup operations-it triggers a use-after-free condition. The tagged presence of both 'Buffer Overflow' and 'Memory Corruption' alongside 'Use After Free' suggests the freed memory may be reallocated for different purposes, allowing controlled memory corruption through heap manipulation techniques common in use-after-free exploitation. The X server typically runs with elevated privileges on Linux systems, making memory corruption vulnerabilities in this component particularly security-sensitive despite the local attack vector.

RemediationAI

Apply vendor-released patches immediately through standard Red Hat update mechanisms using 'yum update xorg-x11-server' or 'dnf update xorg-x11-server' commands appropriate to your RHEL version. Consult the specific Red Hat Security Advisory corresponding to your distribution version from the 15 published advisories (RHSA-2025:19432 through RHSA-2025:22055 available at access.redhat.com/errata) to identify exact fixed package versions. Patched versions are vendor-confirmed available across all affected RHEL releases based on advisory publication. For systems where immediate patching is not feasible, implement compensating controls by restricting local user access to trusted administrators only, disabling remote login capabilities that could provide local shell access to untrusted users, and monitoring X server process crashes through system logging and alerting mechanisms. Consider migrating to Wayland display server protocol where application compatibility permits, as Wayland's architecture eliminates this legacy X11 code path entirely, though this represents a significant configuration change with potential compatibility trade-offs for legacy X11-only applications. No effective workaround exists to disable Xkb extension functionality without breaking keyboard input, making patching the only viable complete remediation.

More in Aix

View all
CVE-2014-3566 LOW POC
3.4 Oct 15

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak

CVE-2013-4011 HIGH POC
7.2 Jul 18

Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a

CVE-2023-28528 HIGH POC
7.8 Apr 28

IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c

CVE-2016-3053 HIGH POC
7.8 Feb 01

IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile

CVE-2016-6079 HIGH POC
7.8 Feb 15

IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob

CVE-2016-8972 HIGH POC
7.8 Feb 15

IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the

CVE-2014-8904 HIGH POC
7.2 Jan 15

lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM

CVE-2012-2179 MEDIUM POC
6.9 Jun 22

libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar

CVE-2014-3977 MEDIUM POC
6.9 Jun 08

libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on

CVE-2026-18835 CRITICAL
9.9 Aug 20

OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru

CVE-2026-16816 CRITICAL
9.9 Aug 19

OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar

CVE-2026-15068 CRITICAL
9.9 Aug 19

OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands

Vendor StatusVendor

SUSE

Severity: High
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Affected
Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.6 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.33 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.18 Affected
Container suse/sl-micro/6.1/base-os-container:2.2.1-5.30 Affected
Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected

Share

CVE-2025-62230 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy