Multiple security issues in the X.Org X server and Xwayland disclosed, new versions released

Developer Olivier Fourdan announced multiple security issues in the X.Org X server and Xwayland, with new versions being released.

The updated versions are xorg-server 21.1.17 and xwayland 24.1.7 that were released today to sort out the issues. Hopefully Linux distributions that ship these packages will be getting updates out quickly, keep an eye on your update manager application.

Here's the list of issues below that were disclosed along with the explanation from the mailing list announcement.

1) CVE-2025-49175: Out-of-bounds access in X Rendering extension (Animated cursors)

The X Rendering extension allows creating animated cursors providing a list of cursors.

By default, the Xserver assumes at least one cursor is provided while a client may actually pass no cursor at all, which causes an out-of-bound read creating the animated cursor and a crash of the Xserver.

2) CVE-2025-49176: Integer overflow in Big Requests Extension

The Big Requests extension allows requests larger than the 16-bit length limit.

It uses integers for the request length and checks for the size not to exceed the maxBigRequestSize limit, but does so after translating the length to integer by multiplying the given size in bytes by 4.

In doing so, it might overflow the integer size limit before actually checking for the overflow, defeating the purpose of the test.

3) CVE-2025-49177: Data leak in XFIXES Extension 6 (XFixesSetClientDisconnectMode)

The handler of XFixesSetClientDisconnectMode does not check the client request length.

A client could send a shorter request and read data from a former request.

4) CVE-2025-49178: Unprocessed client request via bytes to ignore

When reading requests from the clients, the input buffer might be shared and used between different clients.

If a given client sends a full request with non-zero bytes to ignore, the bytes to ignore may still be non-zero even though the request is full, in which case the buffer could be shared with another client who's request will not be processed because of those bytes to ignore, leading to a possible hang of the other client request.

5) CVE-2025-49179: Integer overflow in X Record extension

The RecordSanityCheckRegisterClients() function in the X Record extension implementation of the Xserver checks for the request length, but does not check for integer overflow.

A client might send a very large value for either the number of clients or the number of protocol ranges that will cause an integer overflow in the request length computation, defeating the check for request length.

6) CVE-2025-49180: Integer overflow in RandR extension (RRChangeProviderProperty)

A client might send a request causing an integer overflow when computing the total size to allocate in RRChangeProviderProperty().

See the mailing list announcement for the full details.