This advisory covers a set of nine security vulnerabilities in the xorg-x11-server-Xwayland package, including CVE-2024-9632 (heap-based buffer overflow in tigervnc leading to privilege escalation) and multiple use-after-free, buffer overflow, heap overflow, out-of-bounds write, and uninitialized pointer issues (CVE-2025-26594 through CVE-2025-26601). These vulnerabilities affect the Xwayland server component of the X.Org server, which enables running X clients under Wayland. The vulnerabilities could potentially lead to privilege escalation or other security impacts. Red Hat has issued patches for Red Hat Enterprise Linux 10 and related variants to address these issues.

The vulnerabilities include heap-based buffer overflows, use-after-free bugs, out-of-bounds writes, and use of uninitialized pointers in the Xwayland server. These types of flaws can lead to privilege escalation or denial of service. The advisory rates the security impact as Important (high severity). No known exploits in the wild have been reported at this time.

Red Hat has released security updates for xorg-x11-server-Xwayland in Red Hat Enterprise Linux 10 and related products. Users should apply the provided patches as detailed in the Red Hat advisory RHSA-2025:7458. For update instructions, refer to https://access.redhat.com/articles/11258. Since patches are available, applying the official update is the recommended mitigation.