CVE-2025-49175

MediumCVSS 6.1/10Last modified Nov 4, 2026

Description

A flaw was found in the X Rendering extension's handling of animated cursors. If a client provides no cursors, the server assumes at least one is present, leading to an out-of-bounds read and potential crash.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Weakness enumeration

CWE-125

Affected software

VendorProductVersions
X.Orgxwayland< 24.1.8
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION—
Red HatRed Hat Enterprise Linux 7.7 Advanced Update Support—
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle Support—
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle Support—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8.2 Advanced Update Support—
Red HatRed Hat Enterprise Linux 8.2 Advanced Update Support—
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support—
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support—
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On—
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On—
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support—
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support—
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support—
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On—
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On—
Red HatRed Hat Enterprise Linux 8.6 Telecommunications Update Service—
Red HatRed Hat Enterprise Linux 8.6 Telecommunications Update Service—
Red HatRed Hat Enterprise Linux 8.6 Telecommunications Update Service—
Red HatRed Hat Enterprise Linux 8.6 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 8.6 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 8.6 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 8.8 Extended Update Support Long-Life Add-On—
Red HatRed Hat Enterprise Linux 8.8 Extended Update Support Long-Life Add-On—
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service—
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service—
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service—
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9.0 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.0 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.0 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.4 Extended Update Support—
Red HatRed Hat Enterprise Linux 9.4 Extended Update Support—
Red HatRed Hat Enterprise Linux 9.4 Extended Update Support—
Red HatRed Hat Enterprise Linux 6—

References

Timeline

Published
Jun 17, 2025
Last modified
Nov 4, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-491767.3A flaw was found in the Big Requests extension. The request length is multiplied by 4 before checking against the maximum allowed size, poteCVE-2025-491776.1A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client CVE-2025-491785.5A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' in a client's request can cause the server to skip processinCVE-2025-491797.3A flaw was found in the X Record extension. The RecordSanityCheckRegisterClients function does not check for an integer overflow when computCVE-2025-49189.8An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object. This vulnerability was fixed in Firefox 138CVE-2025-491807.8A flaw was found in the RandR extension, where the RRChangeProviderProperty function does not properly validate input. This issue leads to aCVE-2025-491818.6Due to missing authorization of an API endpoint, unauthorized users can send HTTP GET requests to gather sensitive information. An attacker CVE-2025-491829.8Files in the source code contain login credentials for the admin user and the property configuration password, allowing an attacker to get fCVE-2025-491837.5All communication with the REST API is unencrypted (HTTP), allowing an attacker to intercept traffic between an actor and the webserver. ThiCVE-2025-491847.5A remote unauthorized attacker may gather sensitive information of the application, due to missing authorization of configuration settings oCVE-2025-491855.4The web application is susceptible to cross-site-scripting attacks. An attacker who can create new dashboard widgets can inject malicious JaCVE-2025-491866.5The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it s
CVE-2025-49175: Medium severity, CVSS 6.1 | Vulnix