This advisory covers a set of nine security vulnerabilities in the xorg-x11-server-Xwayland package for Red Hat Enterprise Linux 9. The issues include a heap-based buffer overflow in tigervnc (CVE-2024-9632), multiple use-after-free vulnerabilities (CVE-2025-26594, CVE-2025-26600, CVE-2025-26601), buffer overflows (CVE-2025-26595, CVE-2025-26597), heap overflow (CVE-2025-26596), out-of-bounds write (CVE-2025-26598), and use of uninitialized pointer (CVE-2025-26599). These vulnerabilities affect the Xwayland server, which facilitates running X clients on Wayland. The Red Hat advisory RHSA-2025:7165 provides the update to address these issues. No CVSS scores are provided in the advisory. The update is available for multiple Red Hat Enterprise Linux 9 variants and architectures.

The vulnerabilities include memory corruption issues such as buffer overflows, heap overflows, use-after-free, and use of uninitialized pointers. These types of flaws can potentially lead to privilege escalation or denial of service if exploited. The advisory rates the overall impact as moderate. There are no known exploits in the wild at the time of publication.

Red Hat has released an official security update for xorg-x11-server-Xwayland as part of Red Hat Enterprise Linux 9 updates. Users should apply the update as described in Red Hat advisory RHSA-2025:7165 and the linked article https://access.redhat.com/articles/11258 to remediate these vulnerabilities. The update is available for all supported Red Hat Enterprise Linux 9 variants and architectures. No additional mitigation steps are indicated beyond applying the official update.