Skip to content
Fencer Vulns
medium 6.1

CVE-2025-49175 json

Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: out-of-bounds read in x rendering extension animated cursors

published 2025-06-17 16 mo ago modified 2026-11-04 4 d ago also EUVD-2025-18502

cvss
6.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 28%
public exploits
0
none known

Summary

A flaw was found in the X Rendering extension's handling of animated cursors. If a client provides no cursors, the server assumes at least one is present, leading to an out-of-bounds read and potential crash.

Patch / fix

  • X.Org xwayland 24.1.8
  • Red Hat Red Hat Enterprise Linux 10 0:24.1.5-4.el10_0
  • Red Hat Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION 0:1.1.0-25.el6_10.1
  • Red Hat Red Hat Enterprise Linux 7.7 Advanced Update Support 0:1.8.0-17.el7_7.1
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:1.8.0-36.el7_9.2, 0:1.20.4-32.el7_9
  • Red Hat Red Hat Enterprise Linux 8 0:1.15.0-7.el8_10, 0:1.20.11-26.el8_10, 0:21.1.3-18.el8_10
  • Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support 0:1.9.0-15.el8_2.14, 0:1.20.6-4.el8_2
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 0:1.11.0-8.el8_4.13, 0:1.20.10-2.el8_4
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 0:1.11.0-8.el8_4.13, 0:1.20.10-2.el8_4
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 0:1.12.0-6.el8_6.14, 0:1.20.11-5.el8_6.3, 0:21.1.3-2.el8_6.4
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 0:1.12.0-6.el8_6.14, 0:21.1.3-2.el8_6.4
  • Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service 0:1.12.0-6.el8_6.14, 0:1.20.11-5.el8_6.3, 0:21.1.3-2.el8_6.4
  • Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions 0:1.12.0-6.el8_6.14, 0:1.20.11-5.el8_6.3, 0:21.1.3-2.el8_6.4
  • Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support Long-Life Add-On 0:1.20.11-16.el8_8, 0:21.1.3-11.el8_8
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 0:1.12.0-15.el8_8.14, 0:1.20.11-16.el8_8, 0:21.1.3-11.el8_8
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 0:1.12.0-15.el8_8.14, 0:1.20.11-16.el8_8, 0:21.1.3-11.el8_8
  • Red Hat Red Hat Enterprise Linux 9 0:1.14.1-8.el9_6, 0:1.20.11-31.el9_6, 0:23.2.7-4.el9_6
  • Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions 0:1.11.0-22.el9_0.15, 0:1.20.11-11.el9_0, 0:21.1.3-3.el9_0
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:1.12.0-14.el9_2.12, 0:1.20.11-18.el9_2, 0:21.1.3-8.el9_2
  • Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support 0:1.13.1-8.el9_4.7, 0:1.20.11-26.el9_4, 0:22.1.9-6.el9_4
  • xwayland Debian 14 2:24.1.8-1
  • xorg-server Debian 12 2:21.1.7-3+deb12u10
  • xorg-server Debian 14, Debian 13 2:21.1.16-1.2

debian advisories DEBIAN-CVE-2025-49175

  • xwayland Ubuntu 22.04 LTS 2:22.1.1-1ubuntu0.19
  • xwayland Ubuntu 24.04 LTS 2:23.2.6-1ubuntu0.6
  • xwayland Ubuntu 26.04 LTS, Ubuntu 25.10 2:24.1.6-1ubuntu1
  • xorg-server Ubuntu 22.04 LTS 2:21.1.4-2ubuntu1.7~22.04.15
  • xorg-server Ubuntu 24.04 LTS 2:21.1.12-1ubuntu1.4
  • xorg-server Ubuntu 26.04 LTS, Ubuntu 25.10 2:21.1.18-1ubuntu1
  • xorg-server Ubuntu Pro 16.04 LTS 2:1.18.4-0ubuntu0.12+esm18
  • xorg-server Ubuntu Pro 18.04 LTS 2:1.19.6-1ubuntu4.15+esm13

ubuntu advisories UBUNTU-CVE-2025-49175

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • tigervnc RHEL 8 1.15.0-7.el8_10
  • tigervnc-icons RHEL 8 1.15.0-7.el8_10
  • tigervnc-server RHEL 8 1.15.0-7.el8_10
  • tigervnc-license RHEL 8 1.15.0-7.el8_10
  • tigervnc-selinux RHEL 8 1.15.0-7.el8_10
  • tigervnc-server-module RHEL 8 1.15.0-7.el8_10
  • tigervnc-server-minimal RHEL 8 1.15.0-7.el8_10
  • tigervnc RHEL 9 1.14.1-8.el9_6

red hat advisories RHSA-2025:10410RHSA-2025:10381RHSA-2025:10378RHSA-2025:10377RHSA-2025:10376RHSA-2025:10374

  • xorg-x11-server SLE Module for Development Tools 15 SP7, SLE Module for Basesystem 15 SP7 21.1.15-150700.5.3.1
  • xorg-x11-server SLE Module for Development Tools 15 SP6, SLE Module for Basesystem 15 SP6, openSUSE Leap 15.6 21.1.11-150600.5.12.1
  • xorg-x11-server SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS +1 more 21.1.4-150500.7.35.1
  • xorg-x11-server SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE High Performance Computing 15 SP4-LTSS +3 more 1.20.3-150400.38.57.1
  • xorg-x11-server SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Workstation Extension 15 SP7 +3 more 1.20.3-150200.22.5.105.1
  • xwayland SLE Workstation Extension 15 SP7 24.1.5-150700.3.3.1
  • xwayland SLE Workstation Extension 15 SP6, openSUSE Leap 15.6 24.1.1-150600.5.12.1
  • xorg-x11-server SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 1.19.6-10.83.1

suse advisories SUSE-SU-2025:02012-1SUSE-SU-2025:01981-1SUSE-SU-2025:01980-1SUSE-SU-2025:01979-1SUSE-SU-2025:01978-1SUSE-SU-2025:01977-1

  • xorg-x11-server openSUSE Tumbleweed 21.1.15-6.1
  • xwayland openSUSE Tumbleweed 24.1.8-1.1

opensuse advisories openSUSE-SU-2025:15310-1openSUSE-SU-2025:15311-1

  • xorg-x11-server-Xwayland AlmaLinux 9 23.2.7-4.el9_6
  • xorg-x11-server-Xdmx AlmaLinux 9 1.20.11-31.el9_6
  • xorg-x11-server-Xorg AlmaLinux 9 1.20.11-31.el9_6
  • xorg-x11-server-Xvfb AlmaLinux 9 1.20.11-31.el9_6
  • xorg-x11-server-Xnest AlmaLinux 9 1.20.11-31.el9_6
  • xorg-x11-server-common AlmaLinux 9 1.20.11-31.el9_6
  • xorg-x11-server-source AlmaLinux 9 1.20.11-31.el9_6
  • xorg-x11-server-Xephyr AlmaLinux 9 1.20.11-31.el9_6

almalinux advisories ALSA-2025:9303ALSA-2025:9304ALSA-2025:9305ALSA-2025:9306ALSA-2025:9392

  • xorg-x11-server Rocky Linux 9 1.20.11-31.el9_6
  • xorg-x11-server-Xwayland Rocky Linux 9 23.2.7-4.el9_6
  • tigervnc Rocky Linux 9 1.14.1-8.el9_6
  • xorg-x11-server-Xwayland Rocky Linux 10 24.1.5-4.el10_0
  • xorg-x11-server Rocky Linux 8 1.20.11-26.el8_10
  • xorg-x11-server-Xwayland Rocky Linux 8 21.1.3-18.el8_10
  • tigervnc Rocky Linux 8 1.15.0-7.el8_10

rocky linux advisories RLSA-2025:9303RLSA-2025:9306RLSA-2025:9304RLSA-2025:9305RLSA-2025:9392

  • xwayland Alpine 3.24, Alpine 3.23, Alpine 3.22 24.1.7-r0
  • xorg-server Alpine 3.24, Alpine 3.23, Alpine 3.22 21.1.17-r0

alpine advisories ALPINE-CVE-2025-49175

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • xorg-x11-server CBL-Mariner 2.0 1.20.10-16
  • xorg-x11-server-Xwayland Azure Linux 3.0 24.1.6-2

azure linux advisories AZL-64235AZL-64268

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-49175 updated cvss 6.1

xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Out-of-Bounds Read in X Rendering Extension Animated Cursors

  • Red Hat Enterprise Linux 6 xorg-x11-server, xorg-x11-server-Xdmx, xorg-x11-server-Xorg, xorg-x11-server-Xvfb, xorg-x11-server-Xnest, xorg-x11-server-common, +2 more
    affected: workaround, no fix planned “Will not fix”
  • Red Hat CodeReady Linux Builder EUS (v.9.4) xorg-x11-server-source 1.20.11-26.el9_4
    fixed: vendor fix RHSA-2025:10351
  • Red Hat Enterprise Linux AppStream (v. 8) tigervnc 1.15.0-7.el8_10, tigervnc-icons 1.15.0-7.el8_10, tigervnc-server 1.15.0-7.el8_10, tigervnc-license 1.15.0-7.el8_10, tigervnc-selinux 1.15.0-7.el8_10, xorg-x11-server 1.20.11-26.el8_10, +9 more
    fixed: vendor fix RHSA-2025:9392
  • Red Hat Enterprise Linux AppStream (v. 9) tigervnc 1.14.1-8.el9_6, tigervnc-icons 1.14.1-8.el9_6, tigervnc-server 1.14.1-8.el9_6, tigervnc-license 1.14.1-8.el9_6, tigervnc-selinux 1.14.1-8.el9_6, xorg-x11-server 1.20.11-31.el9_6, +9 more
    fixed: vendor fix RHSA-2025:9306
  • Red Hat Enterprise Linux AppStream (v. 10) xorg-x11-server-Xwayland 24.1.5-4.el10_0
    fixed: vendor fix RHSA-2025:9304
  • Red Hat Enterprise Linux AppStream AUS (v. 8.2) tigervnc 1.9.0-15.el8_2.14, xorg-x11-server 1.20.6-4.el8_2, tigervnc-icons 1.9.0-15.el8_2.14, tigervnc-server 1.9.0-15.el8_2.14, tigervnc-license 1.9.0-15.el8_2.14, xorg-x11-server-Xdmx 1.20.6-4.el8_2, +9 more
    fixed: vendor fix RHSA-2025:10378
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) tigervnc 1.11.0-8.el8_4.13, xorg-x11-server 1.20.10-2.el8_4, tigervnc-icons 1.11.0-8.el8_4.13, tigervnc-server 1.11.0-8.el8_4.13, tigervnc-license 1.11.0-8.el8_4.13, tigervnc-selinux 1.11.0-8.el8_4.13, +9 more
    fixed: vendor fix RHSA-2025:10349
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) tigervnc 1.12.0-6.el8_6.14, tigervnc-icons 1.12.0-6.el8_6.14, tigervnc-server 1.12.0-6.el8_6.14, xorg-x11-server 1.20.11-5.el8_6.3, tigervnc-license 1.12.0-6.el8_6.14, tigervnc-selinux 1.12.0-6.el8_6.14, +9 more Red Hat Enterprise Linux AppStream E4S (v.8.6) tigervnc 1.12.0-6.el8_6.14, tigervnc-icons 1.12.0-6.el8_6.14, tigervnc-server 1.12.0-6.el8_6.14, xorg-x11-server 1.20.11-5.el8_6.3, tigervnc-license 1.12.0-6.el8_6.14, tigervnc-selinux 1.12.0-6.el8_6.14, +9 more
    fixed: vendor fix RHSA-2025:10344
show 18 more
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) tigervnc 1.12.0-15.el8_8.14, xorg-x11-server 1.20.11-16.el8_8, tigervnc-icons 1.12.0-15.el8_8.14, tigervnc-server 1.12.0-15.el8_8.14, tigervnc-license 1.12.0-15.el8_8.14, tigervnc-selinux 1.12.0-15.el8_8.14, +9 more
    fixed: vendor fix RHSA-2025:10355
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) tigervnc 1.11.0-22.el9_0.15, xorg-x11-server 1.20.11-11.el9_0, tigervnc-icons 1.11.0-22.el9_0.15, tigervnc-server 1.11.0-22.el9_0.15, tigervnc-license 1.11.0-22.el9_0.15, tigervnc-selinux 1.11.0-22.el9_0.15, +9 more
    fixed: vendor fix RHSA-2025:10381
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) tigervnc 1.12.0-14.el9_2.12, xorg-x11-server 1.20.11-18.el9_2, tigervnc-icons 1.12.0-14.el9_2.12, tigervnc-server 1.12.0-14.el9_2.12, tigervnc-license 1.12.0-14.el9_2.12, tigervnc-selinux 1.12.0-14.el9_2.12, +9 more
    fixed: vendor fix RHSA-2025:10410
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) tigervnc 1.13.1-8.el9_4.7, tigervnc-icons 1.13.1-8.el9_4.7, tigervnc-server 1.13.1-8.el9_4.7, xorg-x11-server 1.20.11-26.el9_4, tigervnc-license 1.13.1-8.el9_4.7, tigervnc-selinux 1.13.1-8.el9_4.7, +9 more
    fixed: vendor fix RHSA-2025:10374
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) tigervnc 1.11.0-8.el8_4.13, xorg-x11-server 1.20.10-2.el8_4, tigervnc-icons 1.11.0-8.el8_4.13, tigervnc-server 1.11.0-8.el8_4.13, tigervnc-license 1.11.0-8.el8_4.13, tigervnc-selinux 1.11.0-8.el8_4.13, +9 more
    fixed: vendor fix RHSA-2025:10349
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) tigervnc 1.12.0-6.el8_6.14, tigervnc-icons 1.12.0-6.el8_6.14, tigervnc-server 1.12.0-6.el8_6.14, tigervnc-license 1.12.0-6.el8_6.14, tigervnc-selinux 1.12.0-6.el8_6.14, tigervnc-server-module 1.12.0-6.el8_6.14, +2 more
    fixed: vendor fix RHSA-2025:10344
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.8) xorg-x11-server 1.20.11-16.el8_8, xorg-x11-server-Xdmx 1.20.11-16.el8_8, xorg-x11-server-Xorg 1.20.11-16.el8_8, xorg-x11-server-Xvfb 1.20.11-16.el8_8, xorg-x11-server-Xnest 1.20.11-16.el8_8, xorg-x11-server-common 1.20.11-16.el8_8, +2 more
    fixed: vendor fix RHSA-2025:10343
  • Red Hat Enterprise Linux AppStream TUS (v.8.6) tigervnc 1.12.0-6.el8_6.14, tigervnc-icons 1.12.0-6.el8_6.14, tigervnc-server 1.12.0-6.el8_6.14, xorg-x11-server 1.20.11-5.el8_6.3, tigervnc-license 1.12.0-6.el8_6.14, tigervnc-selinux 1.12.0-6.el8_6.14, +9 more
    fixed: vendor fix RHSA-2025:10344
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) tigervnc 1.12.0-15.el8_8.14, xorg-x11-server 1.20.11-16.el8_8, tigervnc-icons 1.12.0-15.el8_8.14, tigervnc-server 1.12.0-15.el8_8.14, tigervnc-license 1.12.0-15.el8_8.14, tigervnc-selinux 1.12.0-15.el8_8.14, +9 more
    fixed: vendor fix RHSA-2025:10355
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) xorg-x11-server-source 1.20.11-31.el9_6, xorg-x11-server-Xwayland 23.2.7-4.el9_6
    fixed: vendor fix RHSA-2025:9303
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) xorg-x11-server-Xwayland-devel 24.1.5-4.el10_0, xorg-x11-server-Xwayland-debuginfo 24.1.5-4.el10_0, xorg-x11-server-Xwayland-debugsource 24.1.5-4.el10_0
    fixed: vendor fix RHSA-2025:9304
  • Red Hat Enterprise Linux CRB (v. 8) xorg-x11-server-source 1.20.11-26.el8_10
    fixed: vendor fix RHSA-2025:9305
  • Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION) tigervnc 1.1.0-25.el6_10.1, tigervnc-server 1.1.0-25.el6_10.1
    fixed: vendor fix RHSA-2025:10377
  • Red Hat Enterprise Linux Server (v. 7 ELS) tigervnc 1.8.0-36.el7_9.2, tigervnc-icons 1.8.0-36.el7_9.2, xorg-x11-server 1.20.4-32.el7_9, tigervnc-server 1.8.0-36.el7_9.2, tigervnc-license 1.8.0-36.el7_9.2, xorg-x11-server-Xorg 1.20.4-32.el7_9, +3 more
    fixed: vendor fix RHSA-2025:10375
  • Red Hat Enterprise Linux Server AUS (v. 7.7) tigervnc 1.8.0-17.el7_7.1, tigervnc-icons 1.8.0-17.el7_7.1, tigervnc-server 1.8.0-17.el7_7.1, tigervnc-license 1.8.0-17.el7_7.1, tigervnc-server-minimal 1.8.0-17.el7_7.1
    fixed: vendor fix RHSA-2025:10376
  • Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION) tigervnc-server-applet 1.1.0-25.el6_10.1, tigervnc-server-module 1.1.0-25.el6_10.1
    fixed: vendor fix RHSA-2025:10377
  • Red Hat Enterprise Linux Server Optional (v. 7 ELS) xorg-x11-server-Xdmx 1.20.4-32.el7_9, xorg-x11-server-Xvfb 1.20.4-32.el7_9, xorg-x11-server-Xnest 1.20.4-32.el7_9, xorg-x11-server-source 1.20.4-32.el7_9, tigervnc-server-applet 1.8.0-36.el7_9.2, tigervnc-server-module 1.8.0-36.el7_9.2, +1 more
    fixed: vendor fix RHSA-2025:10375
  • Red Hat Enterprise Linux Server Optional AUS (v. 7.7) tigervnc-server-applet 1.8.0-17.el7_7.1, tigervnc-server-module 1.8.0-17.el7_7.1
    fixed: vendor fix RHSA-2025:10376

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
16 mo ago

Exploit prediction

0.34% chance of exploitation in the next 30 days, higher than 28% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Affected products

  • X.Org xwayland
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION
  • Red Hat Red Hat Enterprise Linux 7.7 Advanced Update Support
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 6

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.