CVE-2025-62231 Xorg: xmayland: value overflow in xkbsetcompatmap()
A flaw was identified in the X.Org X server’s X Keyboard (Xkb) extension where improper bounds checking in the XkbSetCompatMap() function can cause an unsigned short overflow. If an attacker sends specially crafted input data, the value calculation may overflow, leading to memory corruption or a crash.
Problem types: cwe_id: CWE-190
description: Integer Overflow or Wraparound
Affected products: vendor: X.Org
product: Xwayland
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 10
cpes: cpe:/o:redhat:enterprise_linux:10.0
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 10
cpes: cpe:/o:redhat:enterprise_linux:10.1
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 6 Extended Lifecycle Support  - EXTENSION
cpes: cpe:/o:redhat:rhel_els:6
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 7 Extended Lifecycle Support
cpes: cpe:/o:redhat:rhel_els:7
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 7 Extended Lifecycle Support
cpes: cpe:/o:redhat:rhel_els:7
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/a:redhat:enterprise_linux:8::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/a:redhat:enterprise_linux:8::crb
cpe:/a:redhat:enterprise_linux:8::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/a:redhat:enterprise_linux:8::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.2 Advanced Update Support
cpes: cpe:/a:redhat:rhel_aus:8.2::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.2 Advanced Update Support
cpes: cpe:/a:redhat:rhel_aus:8.2::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
cpes: cpe:/a:redhat:rhel_eus_long_life:8.4::appstream
cpe:/a:redhat:rhel_aus:8.4::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
cpes: cpe:/a:redhat:rhel_eus_long_life:8.4::appstream
cpe:/a:redhat:rhel_aus:8.4::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
cpes: cpe:/a:redhat:rhel_eus_long_life:8.4::appstream
cpe:/a:redhat:rhel_aus:8.4::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
cpes: cpe:/a:redhat:rhel_eus_long_life:8.4::appstream
cpe:/a:redhat:rhel_aus:8.4::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
cpes: cpe:/a:redhat:rhel_tus:8.6::appstream
cpe:/a:redhat:rhel_aus:8.6::appstream
cpe:/a:redhat:rhel_e4s:8.6::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
cpes: cpe:/a:redhat:rhel_tus:8.6::appstream
cpe:/a:redhat:rhel_aus:8.6::appstream
cpe:/a:redhat:rhel_e4s:8.6::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
cpes: cpe:/a:redhat:rhel_tus:8.6::appstream
cpe:/a:redhat:rhel_aus:8.6::appstream
cpe:/a:redhat:rhel_e4s:8.6::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.6 Telecommunications Update Service
cpes: cpe:/a:redhat:rhel_tus:8.6::appstream
cpe:/a:redhat:rhel_aus:8.6::appstream
cpe:/a:redhat:rhel_e4s:8.6::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.6 Telecommunications Update Service
cpes: cpe:/a:redhat:rhel_tus:8.6::appstream
cpe:/a:redhat:rhel_aus:8.6::appstream
cpe:/a:redhat:rhel_e4s:8.6::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.6 Telecommunications Update Service
cpes: cpe:/a:redhat:rhel_tus:8.6::appstream
cpe:/a:redhat:rhel_aus:8.6::appstream
cpe:/a:redhat:rhel_e4s:8.6::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
cpes: cpe:/a:redhat:rhel_tus:8.6::appstream
cpe:/a:redhat:rhel_aus:8.6::appstream
cpe:/a:redhat:rhel_e4s:8.6::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
cpes: cpe:/a:redhat:rhel_tus:8.6::appstream
cpe:/a:redhat:rhel_aus:8.6::appstream
cpe:/a:redhat:rhel_e4s:8.6::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
cpes: cpe:/a:redhat:rhel_tus:8.6::appstream
cpe:/a:redhat:rhel_aus:8.6::appstream
cpe:/a:redhat:rhel_e4s:8.6::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.8 Telecommunications Update Service
cpes: cpe:/a:redhat:rhel_tus:8.8::appstream
cpe:/a:redhat:rhel_e4s:8.8::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.8 Telecommunications Update Service
cpes: cpe:/a:redhat:rhel_tus:8.8::appstream
cpe:/a:redhat:rhel_e4s:8.8::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.8 Telecommunications Update Service
cpes: cpe:/a:redhat:rhel_tus:8.8::appstream
cpe:/a:redhat:rhel_e4s:8.8::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
cpes: cpe:/a:redhat:rhel_tus:8.8::appstream
cpe:/a:redhat:rhel_e4s:8.8::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
cpes: cpe:/a:redhat:rhel_tus:8.8::appstream
cpe:/a:redhat:rhel_e4s:8.8::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
cpes: cpe:/a:redhat:rhel_tus:8.8::appstream
cpe:/a:redhat:rhel_e4s:8.8::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/a:redhat:enterprise_linux:9::crb
cpe:/a:redhat:enterprise_linux:9::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/a:redhat:enterprise_linux:9::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/a:redhat:enterprise_linux:9::crb
cpe:/a:redhat:enterprise_linux:9::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/a:redhat:enterprise_linux:9::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/a:redhat:enterprise_linux:9::crb
cpe:/a:redhat:enterprise_linux:9::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/a:redhat:enterprise_linux:9::crb
cpe:/a:redhat:enterprise_linux:9::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
cpes: cpe:/a:redhat:rhel_e4s:9.0::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
cpes: cpe:/a:redhat:rhel_e4s:9.0::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
cpes: cpe:/a:redhat:rhel_e4s:9.0::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
cpes: cpe:/a:redhat:rhel_e4s:9.2::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
cpes: cpe:/a:redhat:rhel_e4s:9.2::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
cpes: cpe:/a:redhat:rhel_e4s:9.2::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9.4 Extended Update Support
cpes: cpe:/a:redhat:rhel_eus:9.4::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9.4 Extended Update Support
cpes: cpe:/a:redhat:rhel_eus:9.4::appstream
cpe:/a:redhat:rhel_eus:9.4::crb
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9.4 Extended Update Support
cpes: cpe:/a:redhat:rhel_eus:9.4::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 6
cpes: cpe:/o:redhat:enterprise_linux:6
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
version: 3.1
Credits: lang: en
value: Red Hat would like to thank Jan-Niklas Sohn (Trend Micro Zero Day Initiative) for reporting this issue.
Published: 2025-10-30T05:08:32.155Z