Every CVE Search/ Get API key

CVE-2025-49177

Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: data leak in xfixes extension's xfixessetclientdisconnectmode

6.1 MediumFix available

A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
Low

Exploit likelihood

0.44%Up 0.4 points since Jun 18, 2025
90%50%10%1%

What each source reports

CVE List Score used 6.1

Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: data leak in xfixes extension's xfixessetclientdisconnectmode

A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests.

Record
CVE-2025-49177
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Weakness
CWE-200
Updated
2026-11-04
EUVDEUVD-2025-18499 6.1

A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests.

Record
EUVD-2025-18499
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Updated
2026-11-04
GitHub AdvisoriesGHSA-pw35-9xmg-v8xw 5.5

A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not...

A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests.

Record
GHSA-pw35-9xmg-v8xw
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
NVD 6.1

A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests.

Record
CVE-2025-49177
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Weakness
CWE-200
Updated
2026-11-04
OSVALPINE-CVE-2025-49177 6.1

A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests.

Record
ALPINE-CVE-2025-49177
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Updated
2026-11-03
OSVBELL-CVE-2025-49177 6.1
Record
BELL-CVE-2025-49177
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Updated
2026-11-02
Show 18 moreShow less
OSV 6.1

Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: data leak in xfixes extension's xfixessetclientdisconnectmode

A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests.

Record
CVE-2025-49177
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Weakness
CWE-200
Updated
2026-11-06
OSVDEBIAN-CVE-2025-49177 6.1

A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests.

Record
DEBIAN-CVE-2025-49177
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Updated
2026-11-05
OSVRHSA-2025:10258 7.8

Red Hat Security Advisory: xorg-x11-server-Xwayland security update

Record
RHSA-2025:10258
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:9303 7.8

Red Hat Security Advisory: xorg-x11-server and xorg-x11-server-Xwayland security update

Record
RHSA-2025:9303
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:9304 7.8

Red Hat Security Advisory: xorg-x11-server-Xwayland security update

Record
RHSA-2025:9304
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2025:9304 7.8

Important: xorg-x11-server-Xwayland security update

Xwayland is an X server for running X clients under Wayland.

Security Fix(es):

  • xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Out-of-Bounds Read in X Rendering Extension Animated Cursors (CVE-2025-49175)

  • xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in Big Requests Extension (CVE-2025-49176)

  • xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Data Leak in XFIXES Extension's XFixesSetClientDisconnectMode (CVE-2025-49177)

  • xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Unprocessed Client Request Due to Bytes to Ignore (CVE-2025-49178)

  • xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer overflow in X Record extension (CVE-2025-49179)

  • xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in X Resize, Rotate and Reflect (RandR) Extension (CVE-2025-49180)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:9304
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2025-49177 6.1

A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests.

Record
UBUNTU-CVE-2025-49177
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Updated
2026-11-02
OSVALSA-2025:9304 No score

Important: xorg-x11-server-Xwayland security update

Xwayland is an X server for running X clients under Wayland.

Security Fix(es):

  • xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Out-of-Bounds Read in X Rendering Extension Animated Cursors (CVE-2025-49175)
  • xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in Big Requests Extension (CVE-2025-49176)
  • xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Data Leak in XFIXES Extension's XFixesSetClientDisconnectMode (CVE-2025-49177)
  • xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Unprocessed Client Request Due to Bytes to Ignore (CVE-2025-49178)
  • xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer overflow in X Record extension (CVE-2025-49179)
  • xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in X Resize, Rotate and Reflect (RandR) Extension (CVE-2025-49180)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:9304
Updated
2026-11-02
OSVAZL-64271 No score

CVE-2025-49177 affecting package xorg-x11-server-Xwayland for versions less than 24.1.6-2

A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests.

Record
AZL-64271
Updated
2026-11-02
OSVMGASA-2025-0199 No score

Updated x11-server, x11-server-xwayland & tigervnc packages fix security vulnerabilities

Out-of-bounds access in X Rendering extension (Animated cursors). (CVE-2025-49175) Integer overflow in Big Requests Extension. (CVE-2025-49176) Data leak in XFIXES Extension 6 (XFixesSetClientDisconnectMode). (CVE-2025-49177) Unprocessed client request via bytes to ignore. (CVE-2025-49178) Integer overflow in X Record extension. (CVE-2025-49179) Integer overflow in RandR extension (RRChangeProviderProperty). (CVE-2025-49180)

Record
MGASA-2025-0199
Updated
2026-11-02
OSVopenSUSE-SU-2025:15310-1 No score

xorg-x11-server-21.1.15-6.1 on GA media

These are all security issues fixed in the xorg-x11-server-21.1.15-6.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15310-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:15311-1 No score

xwayland-24.1.8-1.1 on GA media

These are all security issues fixed in the xwayland-24.1.8-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15311-1
Updated
2026-11-02
OSVSUSE-SU-2025:01974-1 No score

Security update for xwayland

This update for xwayland fixes the following issues:

  • CVE-2025-49175: Out-of-bounds access in X Rendering extension (Animated cursors) (bsc#1244082).
  • CVE-2025-49176: Integer overflow in Big Requests Extension (bsc#1244084).
  • CVE-2025-49177: Data leak in XFIXES Extension 6 (XFixesSetClientDisconnectMode) (bsc#1244085).
  • CVE-2025-49178: Unprocessed client request via bytes to ignore (bsc#1244087).
  • CVE-2025-49179: Integer overflow in X Record extension (bsc#1244089).
  • CVE-2025-49180: Integer overflow in RandR extension (RRChangeProviderProperty) (bsc#1244090).
Record
SUSE-SU-2025:01974-1
Updated
2026-11-02
OSVSUSE-SU-2025:01975-1 No score

Security update for xwayland

This update for xwayland fixes the following issues:

  • CVE-2025-49175: Out-of-bounds access in X Rendering extension (Animated cursors) (bsc#1244082)
  • CVE-2025-49176: Integer overflow in Big Requests Extension (bsc#1244084)
  • CVE-2025-49177: Data leak in XFIXES Extension 6 (XFixesSetClientDisconnectMode) (bsc#1244085)
  • CVE-2025-49178: Unprocessed client request via bytes to ignore (bsc#1244087)
  • CVE-2025-49179: Integer overflow in X Record extension (bsc#1244089)
  • CVE-2025-49180: Integer overflow in RandR extension (RRChangeProviderProperty) (bsc#1244090)
Record
SUSE-SU-2025:01975-1
Updated
2026-11-02
OSVSUSE-SU-2025:01979-1 No score

Security update for xorg-x11-server

This update for xorg-x11-server fixes the following issues:

  • CVE-2025-49175: Out-of-bounds access in X Rendering extension (Animated cursors) (bsc#1244082).
  • CVE-2025-49176: Integer overflow in Big Requests Extension (bsc#1244084).
  • CVE-2025-49177: Data leak in XFIXES Extension 6 (XFixesSetClientDisconnectMode) (bsc#1244085).
  • CVE-2025-49178: Unprocessed client request via bytes to ignore (bsc#1244087).
  • CVE-2025-49179: Integer overflow in X Record extension (bsc#1244089).
  • CVE-2025-49180: Integer overflow in RandR extension (RRChangeProviderProperty) (bsc#1244090).
Record
SUSE-SU-2025:01979-1
Updated
2026-11-02
OSVSUSE-SU-2025:01980-1 No score

Security update for xorg-x11-server

This update for xorg-x11-server fixes the following issues:

  • CVE-2025-49175: Out-of-bounds access in X Rendering extension (Animated cursors) (bsc#1244082).
  • CVE-2025-49176: Integer overflow in Big Requests Extension (bsc#1244084).
  • CVE-2025-49177: Data leak in XFIXES Extension 6 (XFixesSetClientDisconnectMode) (bsc#1244085).
  • CVE-2025-49178: Unprocessed client request via bytes to ignore (bsc#1244087).
  • CVE-2025-49179: Integer overflow in X Record extension (bsc#1244089).
  • CVE-2025-49180: Integer overflow in RandR extension (RRChangeProviderProperty) (bsc#1244090).
Record
SUSE-SU-2025:01980-1
Updated
2026-11-02
OSVSUSE-SU-2025:01981-1 No score

Security update for xorg-x11-server

This update for xorg-x11-server fixes the following issues:

  • CVE-2025-49175: Out-of-bounds access in X Rendering extension (Animated cursors) (bsc#1244082).
  • CVE-2025-49176: Integer overflow in Big Requests Extension (bsc#1244084).
  • CVE-2025-49177: Data leak in XFIXES Extension 6 (XFixesSetClientDisconnectMode) (bsc#1244085).
  • CVE-2025-49178: Unprocessed client request via bytes to ignore (bsc#1244087).
  • CVE-2025-49179: Integer overflow in X Record extension (bsc#1244089).
  • CVE-2025-49180: Integer overflow in RandR extension (RRChangeProviderProperty) (bsc#1244090).
Record
SUSE-SU-2025:01981-1
Updated
2026-11-02
OSVUSN-7573-1 No score

xorg-server, xwayland vulnerabilities

Nils Emmerich discovered that the X.Org X Server incorrectly handled certain memory operations. An attacker could use these issues to cause the X Server to crash, leading to a denial of service, obtain sensitive information, or possibly execute arbitrary code.

Record
USN-7573-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
xorg-server
Alpine:v3.22
 before 21.1.17-r0
21.1.17-r0
xorg-server
Alpine:v3.23
 before 21.1.17-r0
21.1.17-r0
xorg-server
Alpine:v3.24
 before 21.1.17-r0
21.1.17-r0
xwayland
Alpine:v3.22
 before 24.1.7-r0
24.1.7-r0
xwayland
Alpine:v3.23
 before 24.1.7-r0
24.1.7-r0
xwayland
Alpine:v3.24
 before 24.1.7-r0
24.1.7-r0
xorg-x11-server-Xwayland
AlmaLinux:10
From an advisory covering 6 CVEs
 before 24.1.5-4.el10_0
24.1.5-4.el10_0
xorg-x11-server-Xwayland-devel
AlmaLinux:10
From an advisory covering 6 CVEs
 before 24.1.5-4.el10_0
24.1.5-4.el10_0
xorg-x11-server-Xwayland
Azure Linux:3
 before 24.1.6-2
24.1.6-2
xorg-server
Alpaquita:23
 21.1.4-r1 up to 21.1.18-r0
21.1.18-r0
Show 82 moreShow less
Affected packages
PackageAffectedFixed
xorg-server
Alpaquita:25
 21.1.16-r0 up to 21.1.18-r0
21.1.18-r0
xorg-server
Alpaquita:stream
 21.1.4-r1 up to 21.1.17-r0
21.1.17-r0
xorg-server
Debian:12
 before 2:21.1.7-3+deb12u10, plus listed versions
2:21.1.7-32:21.1.7-3+deb12u12:21.1.7-3+deb12u22:21.1.7-3+deb12u32:21.1.7-3+deb12u4
Show 5 moreShow less
2:21.1.7-3+deb12u52:21.1.7-3+deb12u62:21.1.7-3+deb12u72:21.1.7-3+deb12u82:21.1.7-3+deb12u9
2:21.1.7-3+deb12u10
xorg-server
Debian:13
 before 2:21.1.16-1.2
2:21.1.16-1.2
xorg-server
Debian:14
 before 2:21.1.16-1.2
2:21.1.16-1.2
xwayland
Debian:12
 All versions, plus listed versions
2:22.1.9-12:23.1.0-12:23.1.1-12:23.2.0-12:23.2.1-1
Show 20 moreShow less
2:23.2.2-12:23.2.3-12:23.2.4-12:23.2.6-12:24.0.99.901-12:24.1.0-12:24.1.10-12:24.1.11-12:24.1.12-12:24.1.13-12:24.1.14-12:24.1.2-12:24.1.3-12:24.1.4-12:24.1.4-22:24.1.4-32:24.1.5-12:24.1.6-12:24.1.8-12:24.1.9-1
 None known
xwayland
Debian:13
 All versions, plus listed versions
2:24.1.10-12:24.1.11-12:24.1.12-12:24.1.13-12:24.1.14-12:24.1.6-12:24.1.8-12:24.1.9-1
 None known
xwayland
Debian:14
 before 2:24.1.8-1, plus listed versions
2:24.1.6-1
2:24.1.8-1
xorg-server
Debian:12
From an advisory covering 6 CVEs
 before 2:21.1.7-3+deb12u10, plus listed versions
2:21.1.7-32:21.1.7-3+deb12u12:21.1.7-3+deb12u22:21.1.7-3+deb12u32:21.1.7-3+deb12u4
Show 5 moreShow less
2:21.1.7-3+deb12u52:21.1.7-3+deb12u62:21.1.7-3+deb12u72:21.1.7-3+deb12u82:21.1.7-3+deb12u9
2:21.1.7-3+deb12u10
x11-server
Mageia:9
From an advisory covering 6 CVEs
 before 21.1.8-7.8.mga9
21.1.8-7.8.mga9
x11-server-xwayland
Mageia:9
From an advisory covering 6 CVEs
 before 22.1.9-1.8.mga9
22.1.9-1.8.mga9
tigervnc
Mageia:9
From an advisory covering 6 CVEs
 before 1.13.1-2.8.mga9
1.13.1-2.8.mga9
xorg-x11-server-Xwayland
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 6 CVEs
 before 0:22.1.9-6.el9_4
0:22.1.9-6.el9_4
xorg-x11-server-Xwayland-debuginfo
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 6 CVEs
 before 0:22.1.9-6.el9_4
0:22.1.9-6.el9_4
xorg-x11-server-Xwayland-debugsource
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 6 CVEs
 before 0:22.1.9-6.el9_4
0:22.1.9-6.el9_4
xorg-x11-server
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 0:1.20.11-31.el9_6
0:1.20.11-31.el9_6
xorg-x11-server-Xdmx
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 0:1.20.11-31.el9_6
0:1.20.11-31.el9_6
xorg-x11-server-Xdmx-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 0:1.20.11-31.el9_6
0:1.20.11-31.el9_6
xorg-x11-server-Xephyr
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 0:1.20.11-31.el9_6
0:1.20.11-31.el9_6
xorg-x11-server-Xephyr-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 0:1.20.11-31.el9_6
0:1.20.11-31.el9_6
xorg-x11-server-Xnest
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 0:1.20.11-31.el9_6
0:1.20.11-31.el9_6
xorg-x11-server-Xnest-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 0:1.20.11-31.el9_6
0:1.20.11-31.el9_6
xorg-x11-server-Xorg
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 0:1.20.11-31.el9_6
0:1.20.11-31.el9_6
xorg-x11-server-Xorg-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 0:1.20.11-31.el9_6
0:1.20.11-31.el9_6
xorg-x11-server-Xvfb
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 0:1.20.11-31.el9_6
0:1.20.11-31.el9_6
xorg-x11-server-Xvfb-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 0:1.20.11-31.el9_6
0:1.20.11-31.el9_6
xorg-x11-server-Xwayland
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 0:23.2.7-4.el9_6
0:23.2.7-4.el9_6
xorg-x11-server-Xwayland-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 0:23.2.7-4.el9_6
0:23.2.7-4.el9_6
xorg-x11-server-Xwayland-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 0:23.2.7-4.el9_6
0:23.2.7-4.el9_6
xorg-x11-server-common
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 0:1.20.11-31.el9_6
0:1.20.11-31.el9_6
xorg-x11-server-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 0:1.20.11-31.el9_6
0:1.20.11-31.el9_6
xorg-x11-server-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 0:1.20.11-31.el9_6
0:1.20.11-31.el9_6
xorg-x11-server-Xdmx-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 6 CVEs
 before 0:1.20.11-31.el9_6
0:1.20.11-31.el9_6
xorg-x11-server-Xephyr-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 6 CVEs
 before 0:1.20.11-31.el9_6
0:1.20.11-31.el9_6
xorg-x11-server-Xnest-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 6 CVEs
 before 0:1.20.11-31.el9_6
0:1.20.11-31.el9_6
xorg-x11-server-Xorg-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 6 CVEs
 before 0:1.20.11-31.el9_6
0:1.20.11-31.el9_6
xorg-x11-server-Xvfb-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 6 CVEs
 before 0:1.20.11-31.el9_6
0:1.20.11-31.el9_6
xorg-x11-server-Xwayland
Red Hat:enterprise_linux:9::crb
From an advisory covering 6 CVEs
 before 0:23.2.7-4.el9_6
0:23.2.7-4.el9_6
xorg-x11-server-Xwayland-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 6 CVEs
 before 0:23.2.7-4.el9_6
0:23.2.7-4.el9_6
xorg-x11-server-Xwayland-debugsource
Red Hat:enterprise_linux:9::crb
From an advisory covering 6 CVEs
 before 0:23.2.7-4.el9_6
0:23.2.7-4.el9_6
xorg-x11-server-Xwayland-devel
Red Hat:enterprise_linux:9::crb
From an advisory covering 6 CVEs
 before 0:23.2.7-4.el9_6
0:23.2.7-4.el9_6
xorg-x11-server-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 6 CVEs
 before 0:1.20.11-31.el9_6
0:1.20.11-31.el9_6
xorg-x11-server-debugsource
Red Hat:enterprise_linux:9::crb
From an advisory covering 6 CVEs
 before 0:1.20.11-31.el9_6
0:1.20.11-31.el9_6
xorg-x11-server-devel
Red Hat:enterprise_linux:9::crb
From an advisory covering 6 CVEs
 before 0:1.20.11-31.el9_6
0:1.20.11-31.el9_6
xorg-x11-server-source
Red Hat:enterprise_linux:9::crb
From an advisory covering 6 CVEs
 before 0:1.20.11-31.el9_6
0:1.20.11-31.el9_6
xorg-x11-server-Xwayland
Red Hat:enterprise_linux:10.0
From an advisory covering 6 CVEs
 before 0:24.1.5-4.el10_0
0:24.1.5-4.el10_0
xorg-x11-server-Xwayland-debuginfo
Red Hat:enterprise_linux:10.0
From an advisory covering 6 CVEs
 before 0:24.1.5-4.el10_0
0:24.1.5-4.el10_0
xorg-x11-server-Xwayland-debugsource
Red Hat:enterprise_linux:10.0
From an advisory covering 6 CVEs
 before 0:24.1.5-4.el10_0
0:24.1.5-4.el10_0
xorg-x11-server-Xwayland-devel
Red Hat:enterprise_linux:10.0
From an advisory covering 6 CVEs
 before 0:24.1.5-4.el10_0
0:24.1.5-4.el10_0
xorg-x11-server-Xwayland
Rocky Linux:10
From an advisory covering 6 CVEs
 before 0:24.1.5-4.el10_0
0:24.1.5-4.el10_0
xwayland
SUSE:Linux Enterprise Workstation Extension 15 SP6
From an advisory covering 6 CVEs
 before 24.1.1-150600.5.12.1
24.1.1-150600.5.12.1
xwayland
openSUSE:Leap 15.6
From an advisory covering 6 CVEs
 before 24.1.1-150600.5.12.1
24.1.1-150600.5.12.1
xwayland
SUSE:Linux Enterprise Workstation Extension 15 SP7
From an advisory covering 6 CVEs
 before 24.1.5-150700.3.3.1
24.1.5-150700.3.3.1
xorg-x11-server
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 6 CVEs
 before 21.1.4-150500.7.35.1
21.1.4-150500.7.35.1
xorg-x11-server
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 6 CVEs
 before 21.1.4-150500.7.35.1
21.1.4-150500.7.35.1
xorg-x11-server
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 6 CVEs
 before 21.1.4-150500.7.35.1
21.1.4-150500.7.35.1
xorg-x11-server
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 6 CVEs
 before 21.1.4-150500.7.35.1
21.1.4-150500.7.35.1
xorg-x11-server
SUSE:Linux Enterprise Module for Basesystem 15 SP6
From an advisory covering 6 CVEs
 before 21.1.11-150600.5.12.1
21.1.11-150600.5.12.1
xorg-x11-server
SUSE:Linux Enterprise Module for Development Tools 15 SP6
From an advisory covering 6 CVEs
 before 21.1.11-150600.5.12.1
21.1.11-150600.5.12.1
xorg-x11-server
openSUSE:Leap 15.6
From an advisory covering 6 CVEs
 before 21.1.11-150600.5.12.1
21.1.11-150600.5.12.1
xorg-x11-server
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 6 CVEs
 before 21.1.15-150700.5.3.1
21.1.15-150700.5.3.1
xorg-x11-server
SUSE:Linux Enterprise Module for Development Tools 15 SP7
From an advisory covering 6 CVEs
 before 21.1.15-150700.5.3.1
21.1.15-150700.5.3.1
xorg-server
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
2:1.14.3-3ubuntu22:1.14.3-3ubuntu32:1.14.3-3ubuntu42:1.14.3-5ubuntu12:1.14.4-1ubuntu1
Show 30 moreShow less
2:1.14.4-1ubuntu22:1.14.4.901-0ubuntu22:1.14.5-1ubuntu22:1.14.5-1ubuntu42:1.15.0-1ubuntu12:1.15.0-1ubuntu22:1.15.0-1ubuntu32:1.15.0-1ubuntu42:1.15.0-1ubuntu62:1.15.0-1ubuntu72:1.15.1-0ubuntu12:1.15.1-0ubuntu22:1.15.1-0ubuntu2.12:1.15.1-0ubuntu2.42:1.15.1-0ubuntu2.52:1.15.1-0ubuntu2.62:1.15.1-0ubuntu2.72:1.15.1-0ubuntu2.92:1.15.1-0ubuntu2.102:1.15.1-0ubuntu2.112:1.15.1-0ubuntu2.11+esm22:1.15.1-0ubuntu2.11+esm32:1.15.1-0ubuntu2.11+esm42:1.15.1-0ubuntu2.11+esm52:1.15.1-0ubuntu2.11+esm62:1.15.1-0ubuntu2.11+esm72:1.15.1-0ubuntu2.11+esm82:1.15.1-0ubuntu2.11+esm92:1.15.1-0ubuntu2.11+esm112:1.15.1-0ubuntu2.11+esm12
 None known
xorg-server
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2:1.17.2-1ubuntu92:1.17.2-1ubuntu102:1.17.3-2ubuntu12:1.17.3-2ubuntu22:1.17.3-2ubuntu3
Show 33 moreShow less
2:1.17.3-2ubuntu42:1.18.1-1ubuntu32:1.18.1-1ubuntu42:1.18.3-1ubuntu12:1.18.3-1ubuntu22:1.18.3-1ubuntu2.22:1.18.3-1ubuntu2.32:1.18.4-0ubuntu0.12:1.18.4-0ubuntu0.22:1.18.4-0ubuntu0.32:1.18.4-0ubuntu0.42:1.18.4-0ubuntu0.62:1.18.4-0ubuntu0.72:1.18.4-0ubuntu0.82:1.18.4-0ubuntu0.92:1.18.4-0ubuntu0.102:1.18.4-0ubuntu0.112:1.18.4-0ubuntu0.122:1.18.4-0ubuntu0.12+esm12:1.18.4-0ubuntu0.12+esm22:1.18.4-0ubuntu0.12+esm42:1.18.4-0ubuntu0.12+esm52:1.18.4-0ubuntu0.12+esm62:1.18.4-0ubuntu0.12+esm82:1.18.4-0ubuntu0.12+esm92:1.18.4-0ubuntu0.12+esm102:1.18.4-0ubuntu0.12+esm122:1.18.4-0ubuntu0.12+esm132:1.18.4-0ubuntu0.12+esm142:1.18.4-0ubuntu0.12+esm152:1.18.4-0ubuntu0.12+esm162:1.18.4-0ubuntu0.12+esm172:1.18.4-0ubuntu0.12+esm18
 None known
xorg-server-hwe-16.04
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2:1.18.4-1ubuntu6.1~16.04.12:1.18.4-1ubuntu6.1~16.04.22:1.19.3-1ubuntu1~16.04.22:1.19.3-1ubuntu1~16.04.32:1.19.3-1ubuntu1~16.04.4
Show 17 moreShow less
2:1.19.5-0ubuntu2~16.04.12:1.19.6-1ubuntu4~16.04.12:1.19.6-1ubuntu4.1~16.04.12:1.19.6-1ubuntu4.1~16.04.22:1.19.6-1ubuntu4.1~16.04.32:1.19.6-1ubuntu4.1~16.04.42:1.19.6-1ubuntu4.1~16.04.52:1.19.6-1ubuntu4.1~16.04.62:1.19.6-1ubuntu4.1~16.04.6+esm12:1.19.6-1ubuntu4.1~16.04.6+esm32:1.19.6-1ubuntu4.1~16.04.6+esm42:1.19.6-1ubuntu4.1~16.04.6+esm52:1.19.6-1ubuntu4.1~16.04.6+esm62:1.19.6-1ubuntu4.1~16.04.6+esm72:1.19.6-1ubuntu4.1~16.04.6+esm82:1.19.6-1ubuntu4.1~16.04.6+esm92:1.19.6-1ubuntu4.1~16.04.6+esm10
 None known
xorg-server
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2:1.19.5-0ubuntu22:1.19.6-1ubuntu12:1.19.6-1ubuntu22:1.19.6-1ubuntu32:1.19.6-1ubuntu4
Show 26 moreShow less
2:1.19.6-1ubuntu4.12:1.19.6-1ubuntu4.22:1.19.6-1ubuntu4.32:1.19.6-1ubuntu4.42:1.19.6-1ubuntu4.52:1.19.6-1ubuntu4.62:1.19.6-1ubuntu4.72:1.19.6-1ubuntu4.82:1.19.6-1ubuntu4.92:1.19.6-1ubuntu4.102:1.19.6-1ubuntu4.112:1.19.6-1ubuntu4.122:1.19.6-1ubuntu4.132:1.19.6-1ubuntu4.142:1.19.6-1ubuntu4.152:1.19.6-1ubuntu4.15+esm12:1.19.6-1ubuntu4.15+esm32:1.19.6-1ubuntu4.15+esm42:1.19.6-1ubuntu4.15+esm52:1.19.6-1ubuntu4.15+esm72:1.19.6-1ubuntu4.15+esm82:1.19.6-1ubuntu4.15+esm92:1.19.6-1ubuntu4.15+esm102:1.19.6-1ubuntu4.15+esm112:1.19.6-1ubuntu4.15+esm122:1.19.6-1ubuntu4.15+esm13
 None known
xorg-server-hwe-18.04
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2:1.20.1-3ubuntu2.1~18.04.12:1.20.4-1ubuntu3~18.04.12:1.20.5+git20191008-0ubuntu1~18.04.12:1.20.8-2ubuntu2.1~18.04.12:1.20.8-2ubuntu2.2~18.04.1
Show 15 moreShow less
2:1.20.8-2ubuntu2.2~18.04.22:1.20.8-2ubuntu2.2~18.04.32:1.20.8-2ubuntu2.2~18.04.42:1.20.8-2ubuntu2.2~18.04.52:1.20.8-2ubuntu2.2~18.04.62:1.20.8-2ubuntu2.2~18.04.72:1.20.8-2ubuntu2.2~18.04.82:1.20.8-2ubuntu2.2~18.04.92:1.20.8-2ubuntu2.2~18.04.102:1.20.8-2ubuntu2.2~18.04.112:1.20.8-2ubuntu2.2~18.04.11+esm12:1.20.8-2ubuntu2.2~18.04.11+esm22:1.20.8-2ubuntu2.2~18.04.11+esm32:1.20.8-2ubuntu2.2~18.04.11+esm42:1.20.8-2ubuntu2.2~18.04.11+esm5
 None known
xorg-server
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2:1.20.5+git20191008-0ubuntu12:1.20.6-1ubuntu12:1.20.7-2ubuntu12:1.20.7-2ubuntu22:1.20.8-2ubuntu2
Show 25 moreShow less
2:1.20.8-2ubuntu2.12:1.20.8-2ubuntu2.22:1.20.8-2ubuntu2.32:1.20.8-2ubuntu2.42:1.20.8-2ubuntu2.62:1.20.9-2ubuntu1.1~20.04.12:1.20.9-2ubuntu1.2~20.04.12:1.20.9-2ubuntu1.2~20.04.22:1.20.11-1ubuntu1~20.04.22:1.20.13-1ubuntu1~20.04.22:1.20.13-1ubuntu1~20.04.32:1.20.13-1ubuntu1~20.04.42:1.20.13-1ubuntu1~20.04.52:1.20.13-1ubuntu1~20.04.62:1.20.13-1ubuntu1~20.04.82:1.20.13-1ubuntu1~20.04.92:1.20.13-1ubuntu1~20.04.122:1.20.13-1ubuntu1~20.04.142:1.20.13-1ubuntu1~20.04.152:1.20.13-1ubuntu1~20.04.162:1.20.13-1ubuntu1~20.04.172:1.20.13-1ubuntu1~20.04.182:1.20.13-1ubuntu1~20.04.192:1.20.13-1ubuntu1~20.04.202:1.20.13-1ubuntu1~20.04.20+esm1
 None known
xorg-server
Ubuntu:22.04:LTS
 before 2:21.1.4-2ubuntu1.7~22.04.15, plus listed versions
2:1.20.13-1ubuntu12:1.20.13-1ubuntu22:1.20.14-1ubuntu12:21.1.3-2ubuntu22:21.1.3-2ubuntu2.1
Show 19 moreShow less
2:21.1.3-2ubuntu2.22:21.1.3-2ubuntu2.32:21.1.3-2ubuntu2.42:21.1.3-2ubuntu2.52:21.1.3-2ubuntu2.62:21.1.3-2ubuntu2.72:21.1.3-2ubuntu2.82:21.1.3-2ubuntu2.92:21.1.4-2ubuntu1.7~22.04.12:21.1.4-2ubuntu1.7~22.04.22:21.1.4-2ubuntu1.7~22.04.52:21.1.4-2ubuntu1.7~22.04.72:21.1.4-2ubuntu1.7~22.04.82:21.1.4-2ubuntu1.7~22.04.92:21.1.4-2ubuntu1.7~22.04.102:21.1.4-2ubuntu1.7~22.04.112:21.1.4-2ubuntu1.7~22.04.122:21.1.4-2ubuntu1.7~22.04.132:21.1.4-2ubuntu1.7~22.04.14
2:21.1.4-2ubuntu1.7~22.04.15
xwayland
Ubuntu:22.04:LTS
 before 2:22.1.1-1ubuntu0.19, plus listed versions
2:21.1.2-0ubuntu12:21.1.3-12:21.1.3-1ubuntu12:21.1.4-12:22.1.0-1
Show 17 moreShow less
2:22.1.1-12:22.1.1-1ubuntu0.12:22.1.1-1ubuntu0.22:22.1.1-1ubuntu0.32:22.1.1-1ubuntu0.42:22.1.1-1ubuntu0.52:22.1.1-1ubuntu0.62:22.1.1-1ubuntu0.72:22.1.1-1ubuntu0.92:22.1.1-1ubuntu0.102:22.1.1-1ubuntu0.112:22.1.1-1ubuntu0.122:22.1.1-1ubuntu0.132:22.1.1-1ubuntu0.142:22.1.1-1ubuntu0.152:22.1.1-1ubuntu0.172:22.1.1-1ubuntu0.18
2:22.1.1-1ubuntu0.19
xorg-server
Ubuntu:24.04:LTS
 before 2:21.1.12-1ubuntu1.4, plus listed versions
2:21.1.7-3ubuntu22:21.1.7-3ubuntu2.12:21.1.10-1ubuntu12:21.1.11-2ubuntu12:21.1.12-1ubuntu12:21.1.12-1ubuntu1.12:21.1.12-1ubuntu1.22:21.1.12-1ubuntu1.3
2:21.1.12-1ubuntu1.4
xwayland
Ubuntu:24.04:LTS
 before 2:23.2.6-1ubuntu0.6, plus listed versions
2:23.2.0-12:23.2.0-1ubuntu0.12:23.2.3-12:23.2.4-12:23.2.4-1build1
Show 7 moreShow less
2:23.2.4-1build22:23.2.4-1build32:23.2.6-12:23.2.6-1ubuntu0.12:23.2.6-1ubuntu0.22:23.2.6-1ubuntu0.42:23.2.6-1ubuntu0.5
2:23.2.6-1ubuntu0.6
xorg-server
Ubuntu:25.10
 before 2:21.1.18-1ubuntu1, plus listed versions
2:21.1.16-1ubuntu1
2:21.1.18-1ubuntu1
xwayland
Ubuntu:25.10
 before 2:24.1.6-1ubuntu1, plus listed versions
2:24.1.6-1
2:24.1.6-1ubuntu1
xorg-server
Ubuntu:26.04:LTS
 before 2:21.1.18-1ubuntu1
2:21.1.18-1ubuntu1
xwayland
Ubuntu:26.04:LTS
 before 2:24.1.6-1ubuntu1
2:24.1.6-1ubuntu1
xorg-server
Ubuntu:22.04:LTS
From an advisory covering 6 CVEs
 before 2:21.1.4-2ubuntu1.7~22.04.15, plus listed versions
2:1.20.13-1ubuntu12:1.20.13-1ubuntu22:1.20.14-1ubuntu12:21.1.3-2ubuntu22:21.1.3-2ubuntu2.1
Show 19 moreShow less
2:21.1.3-2ubuntu2.22:21.1.3-2ubuntu2.32:21.1.3-2ubuntu2.42:21.1.3-2ubuntu2.52:21.1.3-2ubuntu2.62:21.1.3-2ubuntu2.72:21.1.3-2ubuntu2.82:21.1.3-2ubuntu2.92:21.1.4-2ubuntu1.7~22.04.12:21.1.4-2ubuntu1.7~22.04.22:21.1.4-2ubuntu1.7~22.04.52:21.1.4-2ubuntu1.7~22.04.72:21.1.4-2ubuntu1.7~22.04.82:21.1.4-2ubuntu1.7~22.04.92:21.1.4-2ubuntu1.7~22.04.102:21.1.4-2ubuntu1.7~22.04.112:21.1.4-2ubuntu1.7~22.04.122:21.1.4-2ubuntu1.7~22.04.132:21.1.4-2ubuntu1.7~22.04.14
2:21.1.4-2ubuntu1.7~22.04.15
xwayland
Ubuntu:22.04:LTS
From an advisory covering 6 CVEs
 before 2:22.1.1-1ubuntu0.19, plus listed versions
2:21.1.2-0ubuntu12:21.1.3-12:21.1.3-1ubuntu12:21.1.4-12:22.1.0-1
Show 17 moreShow less
2:22.1.1-12:22.1.1-1ubuntu0.12:22.1.1-1ubuntu0.22:22.1.1-1ubuntu0.32:22.1.1-1ubuntu0.42:22.1.1-1ubuntu0.52:22.1.1-1ubuntu0.62:22.1.1-1ubuntu0.72:22.1.1-1ubuntu0.92:22.1.1-1ubuntu0.102:22.1.1-1ubuntu0.112:22.1.1-1ubuntu0.122:22.1.1-1ubuntu0.132:22.1.1-1ubuntu0.142:22.1.1-1ubuntu0.152:22.1.1-1ubuntu0.172:22.1.1-1ubuntu0.18
2:22.1.1-1ubuntu0.19
xorg-server
Ubuntu:24.04:LTS
From an advisory covering 6 CVEs
 before 2:21.1.12-1ubuntu1.4, plus listed versions
2:21.1.7-3ubuntu22:21.1.7-3ubuntu2.12:21.1.10-1ubuntu12:21.1.11-2ubuntu12:21.1.12-1ubuntu12:21.1.12-1ubuntu1.12:21.1.12-1ubuntu1.22:21.1.12-1ubuntu1.3
2:21.1.12-1ubuntu1.4
xwayland
Ubuntu:24.04:LTS
From an advisory covering 6 CVEs
 before 2:23.2.6-1ubuntu0.6, plus listed versions
2:23.2.0-12:23.2.0-1ubuntu0.12:23.2.3-12:23.2.4-12:23.2.4-1build1
Show 7 moreShow less
2:23.2.4-1build22:23.2.4-1build32:23.2.6-12:23.2.6-1ubuntu0.12:23.2.6-1ubuntu0.22:23.2.6-1ubuntu0.42:23.2.6-1ubuntu0.5
2:23.2.6-1ubuntu0.6
xorg-x11-server
openSUSE:Tumbleweed
From an advisory covering 6 CVEs
 before 21.1.15-6.1
21.1.15-6.1
xwayland
openSUSE:Tumbleweed
From an advisory covering 6 CVEs
 before 24.1.8-1.1
24.1.8-1.1

History

History
RecordedChangedSources
affectedOSV
affectedEUVD, NVD, OSV
factsCVE List
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-49177 is a medium vulnerability (CVSS 6.1) in X.org Xwayland, published June 17, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.44%, the 38th percentile. Fixed in xorg-server 21.1.17-r0.

References

Show 77 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open