This advisory covers multiple security flaws in the xorg-x11-server package, specifically in the Xwayland component of X.Org, an open-source implementation of the X Window System. The vulnerabilities include use-after-free bugs (CVE-2025-26594, CVE-2025-26600, CVE-2025-26601), buffer and heap overflows (CVE-2025-26595, CVE-2025-26596, CVE-2025-26597), out-of-bounds write (CVE-2025-26598), and use of uninitialized pointer (CVE-2025-26599). These issues could potentially lead to memory corruption and instability. The advisory is specific to Red Hat Enterprise Linux 7 Extended Lifecycle Support and its variants for different architectures. Red Hat has issued an important security update to address these vulnerabilities.

The identified vulnerabilities in xorg-x11-server's Xwayland component can lead to memory corruption issues such as use-after-free, buffer overflow, heap overflow, and out-of-bounds writes. These conditions may cause application crashes, denial of service, or potentially allow an attacker to execute arbitrary code with the privileges of the affected process. The advisory rates the security impact as Important (high severity). No known exploits in the wild have been reported at the time of this advisory.

Red Hat has released updated packages for xorg-x11-server that address these vulnerabilities. Users of Red Hat Enterprise Linux 7 Extended Lifecycle Support and its variants should apply the security update as detailed in the Red Hat advisory RHSA-2025:2879. Instructions for applying the update are available at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official update.