An access of an uninitialized pointer vulnerability (CVE-2025-26599) exists in X.Org and Xwayland within the compRedirectWindow() function. When compCheckRedirect() fails to allocate the backing pixmap, it returns a BadAlloc error but does not properly validate the window tree marked just before, resulting in partially initialized validated data and subsequent use of an uninitialized pointer. This flaw can impact confidentiality, integrity, and availability. Red Hat has released patches for this vulnerability as part of security updates to tigervnc packages in Red Hat Enterprise Linux versions 8 and 9. These updates fix this and several other related vulnerabilities in Xwayland and X.Org components.

The vulnerability allows use of an uninitialized pointer, which can lead to serious impacts on confidentiality, integrity, and availability of affected systems, as reflected by the CVSS score of 7.8 (high severity). Exploitation could cause crashes or potentially allow an attacker with local privileges to execute arbitrary code or cause denial of service. There are no known exploits in the wild at this time. The issue affects multiple architectures and versions of Red Hat Enterprise Linux 8 and 9.

Official patches are available from Red Hat as part of security updates to tigervnc packages for Red Hat Enterprise Linux 8 and 9. Users should apply these updates promptly following Red Hat's guidance at https://access.redhat.com/articles/11258. The vendor advisory confirms the availability of fixes and recommends updating to the patched versions to remediate this vulnerability. No additional mitigation steps are indicated beyond applying the official patches.