Threats affecting pkg:rpm/redhat/xorg-x11-server-xwayland

A buffer overflow vulnerability exists in the handling of pointer barriers in the XFIXES extension of the X.Org X server before version 21.1.25 and XWayland before version 24.1.14. Authenticated X clients could exploit this flaw to crash the X server or potentially execute arbitrary code within the X server context.

Two security vulnerabilities affecting xorg-x11-server-Xwayland in Red Hat Enterprise Linux 10 have been addressed. These include a heap buffer overflow in the glamor Font Atlas component (CVE-2026-55999) and a use-after-free vulnerability in GLX contextTags within CommonMakeCurrent() (CVE-2026-56000). Both issues are rated with high severity by Red Hat Product Security. An update is available to remediate these vulnerabilities.

Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg: xmayland: Use-after-free in XPresentNotify structure creation (CVE-2025-62229) * xorg: xwayland: Use-after-free in Xkb client resource removal (CVE-2025-62230) * xorg: xmayland: Value overflow in XkbSetCompatMap() (CVE-2025-62231) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients. Security Fix(es): * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Out-of-Bounds Read in X Rendering Extension Animated Cursors (CVE-2025-49175) * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in Big Requests Extension (CVE-2025-49176) * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Unprocessed Client Request Due to Bytes to Ignore (CVE-2025-49178) * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer overflow in X Record extension (CVE-2025-49179) * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in X Resize, Rotate and Reflect (RandR) Extension (CVE-2025-49180) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Multiple security vulnerabilities have been identified in the xorg-x11-server-Xwayland component used in Red Hat Enterprise Linux 10 and related products. These include heap-based buffer overflows, use-after-free conditions, out-of-bounds writes, and use of uninitialized pointers. The issues affect the Xwayland server, which allows X clients to run under Wayland. Red Hat has released an important security update addressing these vulnerabilities.