This advisory covers three security vulnerabilities in TigerVNC's Xorg components on Red Hat Enterprise Linux 7 Extended Lifecycle Support. CVE-2025-62229 and CVE-2025-62230 are use-after-free vulnerabilities affecting XPresentNotify structure creation and Xkb client resource removal respectively. CVE-2025-62231 is a value overflow vulnerability in the XkbSetCompatMap function. These vulnerabilities could potentially lead to memory corruption issues. Red Hat has issued an update (RHSA-2025:22096) that addresses these flaws. The advisory does not provide CVSS scores but rates the update as Important. No known exploits in the wild have been reported. The update is available for multiple architectures including x86_64, s390x, ppc64, and ppc64le.

The vulnerabilities involve use-after-free and value overflow conditions in TigerVNC's Xorg components, which could lead to memory corruption. Such issues may allow an attacker to cause a denial of service or potentially execute arbitrary code. The advisory rates the security impact as Important. No known exploits in the wild have been reported at this time.

Red Hat has released an official security update (RHSA-2025:22096) for TigerVNC on Red Hat Enterprise Linux 7 Extended Lifecycle Support that addresses these vulnerabilities. Users should apply this update promptly following Red Hat's published instructions at https://access.redhat.com/articles/11258. Since this is not a cloud service, remediation is the responsibility of the system administrators. No additional mitigations are specified by the vendor.