CVE-2025-49175 is an out-of-bounds read vulnerability in the X Rendering extension's animated cursors handling within the xwayland server of the X.Org project. The issue arises when a client provides zero cursors, but the server incorrectly assumes the presence of at least one cursor, leading to an out-of-bounds memory read and possible server crash. This vulnerability has been assigned a CVSS 3.1 base score of 6.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H), reflecting local attack vector, low complexity, low privileges required, no user interaction, and impacts confidentiality slightly and availability significantly. Red Hat has released patches for affected versions in their Enterprise Linux 8.4 and 9.4 Extended Update Support channels, as documented in their security advisories RHSA-2025:10258 and RHSA-2025:10342. The advisories confirm the availability of official fixes and provide instructions for applying updates. No active exploitation has been reported.

The vulnerability can cause an out-of-bounds read in the xwayland server, potentially leading to a crash and denial of service (availability impact). Confidentiality impact is rated low, with no integrity impact reported. The attack requires local access with low privileges and does not require user interaction. No known exploits are currently in the wild.

Official patches addressing CVE-2025-49175 are available from Red Hat for affected versions of xorg-x11-server-Xwayland in Red Hat Enterprise Linux 8.4 and 9.4 Extended Update Support releases. Users should apply these security updates promptly following Red Hat's guidance at https://access.redhat.com/articles/11258. No additional mitigation actions are indicated by the vendor advisory.