CVE-2025-62231
High · 7.3CVSS
7.3
EPSS
0.3%
Published
Oct 30, 2025
CISA due date
—
The record
A flaw was identified in the X.Org X server’s X Keyboard (Xkb) extension where improper bounds checking in the XkbSetCompatMap() function can cause an unsigned short overflow. If an attacker sends specially crafted input data, the value calculation may overflow, leading to memory corruption or a crash.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Mageia:9 | tigervnc | 0 | 1.13.1-2.9.mga9 |
| Mageia:9 | x11-server | 0 | 21.1.8-7.9.mga9 |
| Mageia:9 | x11-server-xwayland | 0 | 22.1.9-1.9.mga9 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | xorg-x11-server | 0 | 21.1.11-150600.5.20.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | xorg-x11-server | 0 | 21.1.11-150600.5.20.1 |
| SUSE:Linux Enterprise Workstation Extension 15 SP6 | xwayland | 0 | 24.1.1-150600.5.18.1 |
| openSUSE:Leap 15.6 | xorg-x11-server | 0 | 21.1.11-150600.5.20.1 |
| openSUSE:Leap 15.6 | xwayland | 0 | 24.1.1-150600.5.18.1 |
| openSUSE:Leap 16.0 | xorg-x11-server | 0 | 21.1.15-160000.3.1 |
| openSUSE:Leap 16.0 | xwayland | 0 | 24.1.6-160000.3.1 |
| openSUSE:Tumbleweed | xorg-x11-server | 0 | 21.1.15-7.1 |
| openSUSE:Tumbleweed | xwayland | 0 | 24.1.8-4.1 |
Related vulnerabilities
- CVE-2025-62229 A flaw was found in the X.Org X server and Xwayland when processing X11 Present extension… Also affects tigervnc
- CVE-2025-62230 A flaw was discovered in the X.Org X server’s X Keyboard (Xkb) extension when handling… Also affects tigervnc
- CVE-2024-9632 A flaw was found in the X.org server. Also affects tigervnc
- CVE-2024-31083 A use-after-free vulnerability was found in the ProcRenderAddGlyphs() function of Xorg… Also affects tigervnc
- CVE-2024-31081 A heap-based buffer over-read vulnerability was found in the X.org server's… Also affects tigervnc
- CVE-2024-31080 A heap-based buffer over-read vulnerability was found in the X.org server's… Also affects tigervnc
- CVE-2024-21886 A heap buffer overflow flaw was found in the DisableDevice function in the X.Org server. Also affects tigervnc
- CVE-2024-21885 A flaw was found in X.Org server. Also affects tigervnc