This advisory covers five security vulnerabilities in the TigerVNC implementation within the xorg-x11-server-Xwayland package on Red Hat Enterprise Linux 7.7. The issues include an out-of-bounds read in the X Rendering Extension Animated Cursors (CVE-2025-49175), integer overflows in the Big Requests Extension (CVE-2025-49176), unprocessed client requests due to bytes to ignore (CVE-2025-49178), integer overflow in the X Record extension (CVE-2025-49179), and integer overflow in the X Resize, Rotate and Reflect (RandR) Extension (CVE-2025-49180). These vulnerabilities could lead to memory corruption or other unintended behavior in the X server. Red Hat has issued an important security update to fix these vulnerabilities in the tigervnc package for Red Hat Enterprise Linux 7.7.

Successful exploitation of these vulnerabilities could result in memory corruption or crashes in the X server components related to TigerVNC, potentially leading to denial of service or other impacts depending on the context of use. The advisory rates the security impact as Important (high severity). No known exploits in the wild have been reported at this time.

Red Hat has released security updates for the tigervnc package in Red Hat Enterprise Linux 7.7 to address these vulnerabilities. Users should apply the provided updates as detailed in the Red Hat advisory RHSA-2025:10376 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official patches.