The vulnerability CVE-2025-49176 in X.Org xwayland arises from an integer overflow in the Big Requests extension. Specifically, the request length is multiplied by 4 prior to verifying it against the maximum allowed size, potentially causing the length check to be bypassed due to overflow. This can lead to improper handling of oversized requests. The issue is tracked and patched by Red Hat in their xorg-x11-server-Xwayland packages for RHEL 8.4 and 9.4 Extended Update Support. The CVSS 3.1 base score is 7.3 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H, indicating local attack vector, low complexity, low privileges required, no user interaction, unchanged scope, low confidentiality impact, high integrity and availability impacts.

Successful exploitation of this integer overflow vulnerability can lead to bypassing size checks on requests, potentially resulting in high integrity and availability impacts on the affected system. Confidentiality impact is rated low. The vulnerability requires local access with low privileges and no user interaction. There are no known exploits in the wild at this time.

Red Hat has released official security updates for xorg-x11-server-Xwayland addressing CVE-2025-49176 as part of their Extended Update Support for Red Hat Enterprise Linux 8.4 and 9.4. Applying these vendor-provided patches is the recommended remediation. Refer to Red Hat advisories RHSA-2025:10258 and RHSA-2025:10342 and the update instructions at https://access.redhat.com/articles/11258. No additional mitigation steps are required beyond applying the official fixes.