{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"xwayland","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:12","exploited":false,"fixed_versions":[],"id":"tcs_01M5NN7STK5FPRDH22A8ZPM4YB","modified_at":"2026-09-01T20:05:45.114189264Z","published_at":"2025-02-25T16:15:39.537Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2025-26601","https://security-tracker.debian.org/tracker/CVE-2025-26601"],"severity":{"label":"high","score":7.8},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2025-26601#Debian:12/xwayland","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2025-26601"}],"summary":"A use-after-free flaw was found in X.Org and Xwayland. When changing an alarm, the values of the change mask are evaluated one after the other, changing the trigger values as requested, and eventually"}