CVE-2025-26594 is a high-severity use-after-free vulnerability affecting X.Org and Xwayland components, specifically related to the root cursor being referenced as a global variable in the X server. When a client frees the root cursor, the server's internal reference points to freed memory, leading to a use-after-free condition. This can cause memory corruption affecting confidentiality, integrity, and availability. The vulnerability is part of a set of related issues fixed in TigerVNC packages. Red Hat has released security updates for Red Hat Enterprise Linux 8 and 9 to remediate this vulnerability, as detailed in their advisories RHSA-2025:2500 and RHSA-2025:2502. The advisories provide updated package versions and instructions for patching affected systems.

The vulnerability allows a use-after-free condition in the X.Org and Xwayland components, potentially leading to memory corruption that impacts confidentiality, integrity, and availability of affected systems. The CVSS score of 7.8 reflects a high severity level with low attack complexity, requiring low privileges and no user interaction. Exploitation could result in unauthorized code execution or denial of service. However, no known exploits in the wild have been reported. The issue affects multiple architectures and versions of Red Hat Enterprise Linux 8 and 9 as indicated in the vendor advisories.

Red Hat has released official security updates addressing CVE-2025-26594 and related vulnerabilities in TigerVNC packages for Red Hat Enterprise Linux 8 and 9. Applying these vendor-provided patches is the recommended remediation. Administrators should follow the update instructions in the Red Hat advisories RHSA-2025:2500 and RHSA-2025:2502 available at https://access.redhat.com/articles/11258. Since patches are available and provided by the vendor, applying these updates mitigates the vulnerability. No additional mitigation steps are indicated by the vendor advisories.