CVE-2025-49177

MediumCVSS 6.1/10Last modified Nov 4, 2026

Description

A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
X.Org	xwayland	< 24.1.7
Red Hat	Red Hat Enterprise Linux 10	—
Red Hat	Red Hat Enterprise Linux 9	—
Red Hat	Red Hat Enterprise Linux 9	—
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	—
Red Hat	Red Hat Enterprise Linux 6	—
Red Hat	Red Hat Enterprise Linux 6	—
Red Hat	Red Hat Enterprise Linux 7	—
Red Hat	Red Hat Enterprise Linux 7	—
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 9	—

References

Timeline

Published: Jun 17, 2025
Last modified: Nov 4, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-491785.5A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' in a client's request can cause the server to skip processin CVE-2025-491797.3A flaw was found in the X Record extension. The RecordSanityCheckRegisterClients function does not check for an integer overflow when comput CVE-2025-49189.8An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object. This vulnerability was fixed in Firefox 138 CVE-2025-491807.8A flaw was found in the RandR extension, where the RRChangeProviderProperty function does not properly validate input. This issue leads to a CVE-2025-491818.6Due to missing authorization of an API endpoint, unauthorized users can send HTTP GET requests to gather sensitive information. An attacker CVE-2025-491829.8Files in the source code contain login credentials for the admin user and the property configuration password, allowing an attacker to get f CVE-2025-491837.5All communication with the REST API is unencrypted (HTTP), allowing an attacker to intercept traffic between an actor and the webserver. Thi CVE-2025-491847.5A remote unauthorized attacker may gather sensitive information of the application, due to missing authorization of configuration settings o CVE-2025-491855.4The web application is susceptible to cross-site-scripting attacks. An attacker who can create new dashboard widgets can inject malicious Ja CVE-2025-491866.5The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it s CVE-2025-491875.3For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect passwo CVE-2025-491887.5The application sends user credentials as URL parameters instead of POST bodies, making it vulnerable to information gathering.