A flaw was found in the X Rendering extension's handling of animated cursors.
Date: 2025-06
Attack vector: other
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2025-49175
CWE: CWE-125
CVSS: 6.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H)

A flaw was found in the X Rendering extension's handling of animated cursors. If a client provides no cursors, the server assumes at least one is present, leading to an out-of-bounds read and potential crash.


Mitigations:

Architectural layers (MAESTRO):