Red Hat has issued an important security advisory (RHSA-2025:10375) for TigerVNC in the xorg-x11-server-Xwayland package on Red Hat Enterprise Linux 7 Extended Lifecycle Support. The advisory addresses five vulnerabilities: CVE-2025-49175 (Out-of-Bounds Read in X Rendering Extension Animated Cursors), CVE-2025-49176 (Integer Overflow in Big Requests Extension), CVE-2025-49178 (Unprocessed Client Request Due to Bytes to Ignore), CVE-2025-49179 (Integer Overflow in X Record extension), and CVE-2025-49180 (Integer Overflow in X Resize, Rotate and Reflect (RandR) Extension). These vulnerabilities involve memory safety issues such as out-of-bounds reads and integer overflows that could potentially be exploited. Red Hat provides updated TigerVNC packages to remediate these issues. The advisory applies specifically to Red Hat Enterprise Linux 7 Extended Lifecycle Support on multiple architectures including x86_64, s390x, ppc64, and ppc64le.

The identified vulnerabilities involve out-of-bounds reads and integer overflows in TigerVNC components of the X server, which could lead to memory corruption or crashes. While the exact impact is not detailed in the advisory, such issues typically risk denial of service or potential code execution depending on exploitation. The advisory rates the security impact as Important (high severity). There are no known exploits in the wild at the time of the advisory.

Red Hat has released updated TigerVNC packages for Red Hat Enterprise Linux 7 Extended Lifecycle Support that address these vulnerabilities. Users should apply the security update RHSA-2025:10375 promptly to remediate these issues. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.