GestureBuildSprite() copies raw WindowPtr values into the gesture sprite trace via CopySprite() without any reference counting or lifetime management. WindowGone() only repairs touch sprite traces when a window is destroyed -- gesture sprite traces are never checked or cleaned. This leaves stale WindowPtr references in gesture sprites.

When DeliverOneGestureEvent() later dereferences the stale WindowPtr via DeepestSpriteWin(&gi->sprite)->drawable.id, it produces a use-after-free. The freed 4 bytes (drawable.id) can be read back, potentially leaking information about the contents of the freed memory region.

NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/4c9c345d2a10baf956fdefa83bb88681f7c840cf (xorg-server-21.1.25)