This Red Hat security advisory addresses nine vulnerabilities in the xorg-x11-server package, primarily affecting the X.Org implementation and its Xwayland component. The issues include a heap-based buffer overflow in tigervnc (CVE-2024-9632), multiple use-after-free vulnerabilities (CVE-2025-26594, CVE-2025-26600, CVE-2025-26601), buffer overflows (CVE-2025-26595, CVE-2025-26597), a heap overflow (CVE-2025-26596), an out-of-bounds write (CVE-2025-26598), and use of an uninitialized pointer (CVE-2025-26599). These vulnerabilities could allow privilege escalation and other impacts. The advisory is rated as moderate severity by Red Hat and applies to Red Hat Enterprise Linux 9 and its extended update support and related variants. A security update is available to address these vulnerabilities.

The vulnerabilities include heap-based buffer overflows, use-after-free conditions, buffer overflows, heap overflows, out-of-bounds writes, and use of uninitialized pointers in the xorg-x11-server and Xwayland components. These issues can lead to privilege escalation and potentially compromise the integrity and security of affected systems. Red Hat rates the overall security impact as moderate.

Red Hat has released security updates for xorg-x11-server in Red Hat Enterprise Linux 9 and its variants to address these vulnerabilities. Users should apply the provided updates as detailed in the Red Hat advisory RHSA-2025:7163. For update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official patches.