xorg

A subtle type‑confusion in the X.Org cursor code — tracked as CVE‑2024‑0409 — can corrupt the SELinux labeling context and has been patched upstream; administrators running Xorg, Xwayland, Xephyr or affected VNC stacks should treat this as an availability‑first, high‑impact bug and apply vendor...

A critical use‑after‑free vulnerability in the X.Org X server and Xwayland — tracked as CVE‑2025‑62229 — has been published and fixed upstream; the flaw arises in the handling of X11 Present extension notifications and can leave dangling pointers that lead to memory corruption or crashes, with...

A newly disclosed vulnerability in the X.Org Server’s X Keyboard (Xkb) extension — tracked as CVE‑2025‑62231 — allows a specially crafted X protocol request to trigger an arithmetic wrap/unsigned‑short overflow in XkbSetCompatMap, producing memory corruption or crashes that can fully deny...

A serious integer‑overflow bug in the X.Org X server’s Record extension (tracked as CVE-2025-49179) can be abused by a local client to bypass request length checks and force a denial‑of‑service against Xwayland/TigerVNC‑backed sessions, and vendors including Debian and Red Hat have published...

A recently recorded vulnerability in the X.Org server and related packages — tracked as CVE-2025-49175 — allows an attacker with local or limited network access to trigger an out‑of‑bounds read in the X Rendering extension’s animated cursor handling, causing crashes and sustained...