CVE-2025-49177

Impact

A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests.

Affected packages

This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.

Weakness classification

References

• NVD record
• CVE.org record
• https://access.redhat.com/errata/RHSA-2025:10258
• https://access.redhat.com/errata/RHSA-2025:9303
• https://access.redhat.com/errata/RHSA-2025:9304
• https://access.redhat.com/security/cve/CVE-2025-49177
• https://bugzilla.redhat.com/show_bug.cgi?id=2369955
• https://gitlab.freedesktop.org/xorg/xserver/-/commit/ab02fb96b1c701c3bb47617d965522c34befa6af
• https://www.x.org/wiki/Development/Security/