The vulnerability CVE-2025-49180 affects the xwayland component of X.Org, where the RRChangeProviderProperty function in the RandR extension does not properly validate input parameters. This leads to an integer overflow during the calculation of the total size for memory allocation, potentially causing memory corruption. The issue is rated with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating local attack vector with low complexity, requiring low privileges and no user interaction, and impacting confidentiality, integrity, and availability. Red Hat advisories RHSA-2025:10258 and RHSA-2025:10342 confirm the vulnerability and provide patches for Red Hat Enterprise Linux 8.4 and 9.4 variants. The advisories include updated packages for xorg-x11-server-Xwayland and related components to address this and several related vulnerabilities.

Successful exploitation of this integer overflow vulnerability may lead to memory corruption, which can result in a complete compromise of confidentiality, integrity, and availability of the affected system. The CVSS score of 7.8 reflects a high impact on the system, potentially allowing an attacker with local access and low privileges to execute arbitrary code or cause denial of service.

Red Hat has released official security updates addressing CVE-2025-49180 for Red Hat Enterprise Linux 8.4 and 9.4. Users should apply the provided patches from the Red Hat advisories RHSA-2025:10258 and RHSA-2025:10342 promptly to remediate this vulnerability. Detailed update instructions are available in the Red Hat knowledge base article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying these official fixes.