# CVE-2025-62230: X.Org X server use-after-free in Xkb client resource removal

Source: https://junglewise.ai/threats/cve-2025-62230-x-org-x-server-use-after-free-in-xkb-client-resource-removal  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-10-30. Updated: 2026-06-29  
License: CC BY 4.0 with a link back

CVE-2025-62230 · Severity: high · CVSS 7.3 · Published 2025-10-30

A vulnerability was found in the X.Org X server, a fundamental component used to manage graphical displays and keyboard input on Linux and Unix-like systems. A flaw in how the system cleans up keyboard resources when a user or application disconnects can lead to memory corruption. In practice, a local attacker could exploit this to crash the graphical interface or potentially gain unauthorized access to sensitive information stored in memory.

Technologies: [Red Hat Enterprise Linux 8](https://junglewise.ai/threats/technologies/enterprise-linux-8), [Red Hat Enterprise Linux 9](https://junglewise.ai/threats/technologies/enterprise-linux-9), [X.Org Foundation X Server](https://junglewise.ai/threats/technologies/x-server), [X.Org Foundation Xwayland](https://junglewise.ai/threats/technologies/xwayland). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat), [X.Org Foundation](https://junglewise.ai/threats/vendors/x-org-foundation).

## Quick answers

**Is CVE-2025-62230 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-62230 being exploited in the wild.

**How severe is CVE-2025-62230?** High severity, with a CVSS score of 7.3, published 30 October 2025.

**Which products and versions are affected?** Red Hat Enterprise Linux 8 xorg-x11-server-Xwayland < 21.1.3-19.el8_10; Red Hat Enterprise Linux 9 xorg-x11-server < 1.20.11-32.el9_6; X.Org Foundation X Server < 21.1.14; X.Org Foundation Xwayland < 24.1.4.

**Is there a fix for CVE-2025-62230?** A patch was published on 2025-11-03: Red Hat released security updates (RHSA-2025:19432) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-62230 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2025-62230?** Check whether you run Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, X.Org Foundation X Server or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free vulnerability exists in the X.Org X server’s X Keyboard (Xkb) extension. The root cause is a failure to properly detach related resources before freeing data structures during client resource cleanup. A local attacker with the ability to connect to the X server can trigger this condition by disconnecting a specially crafted client, leading to memory corruption or a denial-of-service (crash). While primarily impacting availability, the memory corruption could potentially be leveraged for local privilege escalation or information disclosure. Patches have been released by X.Org and major Linux distributions including Red Hat and Debian.

## Affected products

- X.Org X server < 21.1.14
- X.Org Xwayland < 24.1.4
- Red Hat Enterprise Linux 8 xorg-x11-server-Xwayland < 21.1.3-19.el8_10
- Red Hat Enterprise Linux 9 xorg-x11-server < 1.20.11-32.el9_6

## Timeline

- 2025-10-28: disclosed: Public disclosure on oss-security mailing list
- 2025-10-30: advisory: NVD publication date
- 2025-11-03: patched: Red Hat released security updates (RHSA-2025:19432)

## References

- [https://gitlab.freedesktop.org/xorg/xserver](https://gitlab.freedesktop.org/xorg/xserver)
- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/errata/RHSA-2025:19432](https://access.redhat.com/errata/RHSA-2025:19432)
- [https://access.redhat.com/errata/RHSA-2025:19433](https://access.redhat.com/errata/RHSA-2025:19433)
- [https://access.redhat.com/errata/RHSA-2025:19434](https://access.redhat.com/errata/RHSA-2025:19434)
- [https://access.redhat.com/errata/RHSA-2025:19435](https://access.redhat.com/errata/RHSA-2025:19435)
- [https://access.redhat.com/errata/RHSA-2025:19489](https://access.redhat.com/errata/RHSA-2025:19489)

## Related threats

- [X.Org X Server double free in XKB SetGeometry](https://junglewise.ai/threats/cve-2026-88812-a-double-free-in-xkb-setgeometryin-x-org-x-server-before-21-1-25)
- [Samba AD DC LDAP filter injection and ACL bypass in Compare requests](https://junglewise.ai/threats/cve-2026-58222-samba-ad-dc-ldap-filter-injection-and-acl-bypass-in-compare)
- [Samba KDC out-of-bounds read in kpasswd service](https://junglewise.ai/threats/cve-2026-58216-samba-kdc-out-of-bounds-read-in-kpasswd-service)
- [Samba internal DNS server denial of service via TKEY cache exhaustion](https://junglewise.ai/threats/cve-2026-58218-samba-internal-dns-server-denial-of-service-via-tkey-cache)
- [Red Hat PCP auth bypass in pmproxy /store endpoint](https://junglewise.ai/threats/cve-2026-16527-red-hat-pcp-auth-bypass-in-pmproxy-store-endpoint)