This security advisory from Red Hat addresses multiple vulnerabilities in TigerVNC and X.Org's Xwayland component, including use-after-free (CVE-2025-26594, CVE-2025-26600, CVE-2025-26601), buffer overflows (CVE-2025-26595, CVE-2025-26597), heap overflow (CVE-2025-26596), out-of-bounds write (CVE-2025-26598), and use of uninitialized pointer (CVE-2025-26599). These issues affect the remote display system TigerVNC and its Xwayland integration, potentially impacting remote desktop functionality. Red Hat has released security updates for Red Hat Enterprise Linux 7 Extended Lifecycle Support to address these vulnerabilities. The advisory references multiple bugzilla entries and provides package updates for various architectures. No CVSS scores are included in the advisory, but the severity is rated as Important.

The vulnerabilities include memory corruption issues such as use-after-free, buffer overflows, heap overflow, and out-of-bounds writes in the Xwayland component used by TigerVNC. These could potentially lead to crashes or arbitrary code execution if exploited. The advisory does not specify known exploits in the wild. The impact is rated as Important by Red Hat, indicating significant security concerns that warrant prompt attention.

Red Hat has released security updates for TigerVNC and related Xwayland components in Red Hat Enterprise Linux 7 Extended Lifecycle Support. Users should apply the provided updates as detailed in the Red Hat advisory RHSA-2025:2861 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated in the advisory. Patch status is confirmed as available via official Red Hat updates.