This advisory covers a set of security fixes for xorg-x11-server-Xwayland in Red Hat Enterprise Linux 9. The vulnerabilities include a heap-based buffer overflow privilege escalation in tigervnc (CVE-2024-9632), several use-after-free flaws (CVE-2025-26594, CVE-2025-26600, CVE-2025-26601), out-of-bounds writes (CVE-2025-26598), buffer overflows (CVE-2025-26595, CVE-2025-26597), heap overflow (CVE-2025-26596), and use of uninitialized pointers (CVE-2025-26599). These flaws affect the Xwayland server component that enables X clients to run on Wayland. Red Hat has released patches to address these vulnerabilities.

The vulnerabilities could allow privilege escalation and potentially other impacts due to memory corruption issues such as buffer overflows, use-after-free, and out-of-bounds writes in the Xwayland server. The overall security impact is rated as moderate by Red Hat. No known exploits in the wild have been reported at this time.

A security update is available from Red Hat for xorg-x11-server-Xwayland on Red Hat Enterprise Linux 9. Users should apply the update as described in the Red Hat advisory RHSA-2025:7165 and the linked documentation. Red Hat provides official patches and recommends updating affected systems promptly to mitigate these vulnerabilities.