The vulnerability CVE-2025-49177 in X.Org's xwayland involves a flaw in the XFIXES extension where the XFixesSetClientDisconnectMode handler does not properly validate the length of client requests. This improper validation allows a client to read memory that was not intended to be accessible, potentially exposing sensitive information. The issue is part of a set of vulnerabilities fixed in xorg-x11-server-Xwayland packages for Red Hat Enterprise Linux 9.x. The CVSS 3.1 base score is 6.1, with attack vector local, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact.

An attacker with local access and low privileges can exploit this vulnerability to read sensitive memory contents from the XFIXES extension in xwayland. This leads to an exposure of sensitive information, impacting confidentiality. There is no impact on integrity, and availability impact is low. No known exploits are reported in the wild at this time.

Red Hat has released official security updates for xorg-x11-server-Xwayland in Red Hat Enterprise Linux 9.4 and later 9.x versions that address this vulnerability. Users should apply these updates promptly. For detailed update instructions, refer to Red Hat's advisory and article at https://access.redhat.com/articles/11258. No additional mitigation steps are required beyond applying the official patches.