This advisory covers three security vulnerabilities in the xorg-x11-server package for Red Hat Enterprise Linux 9.4 Extended Update Support: CVE-2025-62229 is a use-after-free vulnerability in the XPresentNotify structure creation within xmayland; CVE-2025-62230 is a use-after-free vulnerability in the Xkb client resource removal in xwayland; CVE-2025-62231 is a value overflow in the XkbSetCompatMap function in xmayland. These vulnerabilities could potentially lead to memory corruption issues. Red Hat has released patches addressing these flaws in version 1.20.11-27.el9_4 of the xorg-x11-server package. The advisory does not provide CVSS scores but rates the overall impact as moderate.

The identified vulnerabilities involve use-after-free conditions and a value overflow in critical components of the X Window System server implementation. Such flaws can lead to memory corruption, which may be exploited to cause application crashes or potentially execute arbitrary code with the privileges of the affected service. The advisory rates the security impact as moderate, indicating a significant but not critical risk level. No known exploits in the wild have been reported at the time of the advisory.

Red Hat has released an official security update for xorg-x11-server addressing these vulnerabilities. Users of Red Hat Enterprise Linux 9.4 Extended Update Support should apply the update to version 1.20.11-27.el9_4 or later as soon as possible. Detailed instructions for applying the update are available in the Red Hat advisory linked in the references. No additional mitigations are specified or required beyond applying the official patch.