An integer overflow vulnerability exists in the X Record extension within the xwayland component of X.Org. Specifically, the RecordSanityCheckRegisterClients function fails to check for integer overflow when computing the length of a client request, which can allow a client to bypass length validation checks. This vulnerability is tracked as CVE-2025-49179 with a CVSS 3.1 base score of 7.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H), indicating that a local attacker with low privileges can exploit this flaw to cause high impact on confidentiality and availability, and limited impact on integrity. Red Hat has released security advisories and patches for xorg-x11-server and xorg-x11-server-Xwayland packages in Red Hat Enterprise Linux 8.4 and 9.4 Extended Update Support to fix this and related vulnerabilities. The advisories confirm the availability of official fixes and provide instructions for applying updates.

The vulnerability allows a local attacker with low privileges to bypass request length checks due to an integer overflow, potentially leading to high confidentiality and availability impact, and limited integrity impact. This could result in unauthorized access to sensitive information or denial of service conditions in the xwayland server environment. The CVSS score of 7.3 reflects the high severity of this issue.

Official patches are available from Red Hat for affected versions of xorg-x11-server and xorg-x11-server-Xwayland in Red Hat Enterprise Linux 8.4 and 9.4 Extended Update Support. Users should apply these updates promptly following Red Hat's guidance at https://access.redhat.com/articles/11258. No additional mitigations are specified by the vendor advisory. Patch status is confirmed as official-fix.