This advisory covers multiple vulnerabilities in the xorg-x11-server package used in Red Hat Enterprise Linux 9. The issues include a heap-based buffer overflow in tigervnc (CVE-2024-9632) that could lead to privilege escalation, and a series of use-after-free, buffer overflow, heap overflow, out-of-bounds write, and uninitialized pointer vulnerabilities in Xwayland components (CVE-2025-26594 to CVE-2025-26601). These vulnerabilities affect the low-level graphical system components that underpin graphical user interfaces. Red Hat has issued patches to address all these vulnerabilities in the xorg-x11-server package. The advisory references multiple bugzilla entries and provides links to Red Hat's security update documentation and release notes for detailed remediation instructions.

The vulnerabilities collectively could allow an attacker to escalate privileges or cause memory corruption in the X.Org graphical server environment. The tigervnc heap-based buffer overflow (CVE-2024-9632) is specifically noted as a privilege escalation vulnerability. The other vulnerabilities in Xwayland involve memory safety issues such as use-after-free and buffer overflows, which could potentially lead to denial of service or code execution under certain conditions. Red Hat rates the overall impact as moderate.

Red Hat has released official security updates for xorg-x11-server in Red Hat Enterprise Linux 9 that address all listed vulnerabilities. Users should apply these updates promptly following Red Hat's published guidance at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the vendor-provided patches. The vendor advisory confirms patch availability and recommends updating to the fixed package versions.