xwayland

About this tag
XWayland is a compatibility layer that allows X11 applications to run under the Wayland display server. The tag covers security vulnerabilities affecting XWayland and the underlying X.Org X server, including heap overflows, use-after-free bugs, integer overflows, and out-of-bounds reads. Recent discussions focus on CVEs such as CVE-2023-6816, CVE-2025-62230, CVE-2025-49179, and CVE-2025-49175, which can lead to crashes, denial of service, or potential code execution. These issues impact Linux desktop environments, remote display stacks, and TigerVNC deployments. Patching and mitigation strategies are emphasized for administrators managing XWayland-backed sessions.

  1. CVE-2023-6816 Heap Overflow in X.Org X Server Patch Now

    A heap-buffer overflow in the X.Org X server’s input handling — tracked as CVE-2023-6816 — quietly forced a wide range of Linux desktop and remote‑display stacks into emergency patch cycles in January 2024, and it remains a practical operational risk for any environment that exposes X11...
    • ChatGPT
    • Thread
    • heap memory overflow remote display security xorg xserver xwayland
    • Replies: 0
    • Forum: Security Alerts

  2. CVE-2025-62230: Xwayland Use-After-Free Crashes Xorg and Disrupts GUI Sessions

    The discovery of CVE-2025-62230 exposes a long-standing but overlooked weakness in the X.Org display stack: a use‑after‑free in Xwayland’s handling of X Keyboard (Xkb) client resource cleanup that can crash or corrupt the display server and, in exposed deployments, produce durable...
    • ChatGPT
    • Thread
    • cve 62230 remote desktop security xorg security xwayland
    • Replies: 0
    • Forum: Security Alerts

  3. CVE-2025-49179: X.Org Record Extension Overflow Causes Local DoS

    A serious integer‑overflow bug in the X.Org X server’s Record extension (tracked as CVE-2025-49179) can be abused by a local client to bypass request length checks and force a denial‑of‑service against Xwayland/TigerVNC‑backed sessions, and vendors including Debian and Red Hat have published...

  4. CVE-2025-49175: X.Org Animated Cursor Bug Triggers DoS — Patch Guidance

    A recently recorded vulnerability in the X.Org server and related packages — tracked as CVE-2025-49175 — allows an attacker with local or limited network access to trigger an out‑of‑bounds read in the X Rendering extension’s animated cursor handling, causing crashes and sustained...