This advisory covers multiple security fixes in the xorg-x11-server-Xwayland package for Red Hat Enterprise Linux 10. The vulnerabilities include a heap-based buffer overflow in tigervnc (CVE-2024-9632), several use-after-free vulnerabilities (CVE-2025-26594, CVE-2025-26600, CVE-2025-26601), buffer overflows (CVE-2025-26595, CVE-2025-26597), heap overflow (CVE-2025-26596), out-of-bounds write (CVE-2025-26598), and use of uninitialized pointer (CVE-2025-26599). These issues affect the Xwayland server component that allows X clients to run under Wayland, potentially enabling privilege escalation or other security impacts. The Red Hat advisory RHSA-2025:7458 provides details and patches for these vulnerabilities.

The vulnerabilities could allow an attacker to escalate privileges or cause denial of service by exploiting memory corruption issues such as buffer overflows, heap overflows, use-after-free, and out-of-bounds writes in the Xwayland server. This could compromise the confidentiality, integrity, or availability of affected systems running Red Hat Enterprise Linux 10.

Red Hat has released an important security update for xorg-x11-server-Xwayland in Red Hat Enterprise Linux 10. Users should apply the update as described in the Red Hat advisory RHSA-2025:7458 and the referenced article https://access.redhat.com/articles/11258 to remediate these vulnerabilities. No additional mitigations are indicated by the vendor advisory.