Red Hat Product Security has issued an important security advisory (RHSA-2025:9303) addressing several vulnerabilities in xorg-x11-server and xorg-x11-server-Xwayland, including CVE-2025-49175 (out-of-bounds read in X Rendering Extension Animated Cursors), CVE-2025-49176 (integer overflow in Big Requests Extension), CVE-2025-49178 (unprocessed client request due to bytes to ignore), CVE-2025-49179 (integer overflow in X Record extension), and CVE-2025-49180 (integer overflow in X Resize, Rotate and Reflect (RandR) Extension). These issues affect the tigervnc component of the X.Org server implementation. The advisory provides updated packages for Red Hat Enterprise Linux 9 across multiple architectures and extended update support versions. No CVSS scores are provided in the advisory, but the overall impact is rated as important (high severity).

The vulnerabilities could lead to out-of-bounds memory reads and integer overflows within the X.Org server components, potentially causing crashes or other unintended behavior. The exact impact details and exploitation scenarios are not provided in the advisory. No known exploits in the wild have been reported at this time.

Red Hat has released updated packages for xorg-x11-server and xorg-x11-server-Xwayland that address these vulnerabilities. Users of Red Hat Enterprise Linux 9 and its variants should apply the security updates as detailed in the Red Hat advisory RHSA-2025:9303 and the referenced update article (https://access.redhat.com/articles/11258). Patch status is confirmed with official fixes available. No additional mitigation steps are indicated beyond applying the vendor-provided updates.