This advisory covers six security vulnerabilities in the xorg-x11-server-Xwayland package, which is an X server for running X clients under Wayland. The issues include an out-of-bounds read in the X Rendering Extension Animated Cursors (CVE-2025-49175), integer overflows in the Big Requests Extension (CVE-2025-49176), data leak in the XFIXES Extension's XFixesSetClientDisconnectMode (CVE-2025-49177), unprocessed client request due to bytes to ignore (CVE-2025-49178), integer overflow in the X Record extension (CVE-2025-49179), and integer overflow in the X Resize, Rotate and Reflect (RandR) Extension (CVE-2025-49180). These vulnerabilities were discovered in the tigervnc code within the xorg-x11-server and could lead to various security impacts. Red Hat has released updated packages for Red Hat Enterprise Linux 10 and its variants to remediate these issues.

The vulnerabilities could allow attackers to cause out-of-bounds reads, integer overflows, data leaks, and unprocessed client requests within the X server environment. This may lead to potential information disclosure or denial of service conditions. The advisory rates the security impact as Important (high). There are no known exploits in the wild at the time of this advisory.

Red Hat has released updated xorg-x11-server-Xwayland packages for Red Hat Enterprise Linux 10 and related products to address these vulnerabilities. Users should apply the security updates as detailed in the Red Hat advisory RHSA-2025:9304 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official patches.