CVE-2025-49175: A flaw was found in the X Rendering extension's handling of animated cursors. If a client provides no cursors, the server assumes at least one is present…

PriorityP426medium6.1CVSS 3.1

AVLACLPRLUINSUCLINAH

EPSS

0.29%

20.9th percentile

A flaw was found in the X Rendering extension's handling of animated cursors. If a client provides no cursors, the server assumes at least one is present, leading to an out-of-bounds read and potential crash.

Affected

11 ranges

Vendor	Product	Version range	Fixed in
debian	xorg-server	< xorg-server 2:21.1.7-3+deb12u10 (bookworm)	xorg-server 2:21.1.7-3+deb12u10 (bookworm)
debian	xwayland	< xorg-server 2:21.1.7-3+deb12u10 (bookworm)	xorg-server 2:21.1.7-3+deb12u10 (bookworm)
msrc	azl3_wayland_1.22.0-1_on_azure_linux_3.0	—	—
msrc	azl3_xorg-x11-server-xwayland_24.1.6-2_on_azure_linux_3.0	—	—
msrc	cbl2_xorg-x11-server_1.20.10-16_on_cbl_mariner_2.0	—	—
x.org	xorg-server	>= 0 < 2:1.20.11-1+deb11u16	2:1.20.11-1+deb11u16
x.org	xorg-server	>= 0 < 2:21.1.7-3+deb12u10	2:21.1.7-3+deb12u10
x.org	xorg-server	>= 0 < 2:21.1.16-1.2	2:21.1.16-1.2
x.org	xorg-server	>= 0 < 2:21.1.16-1.2	2:21.1.16-1.2
x.org	xwayland	< 24.1.8	24.1.8
x.org	xwayland	>= 0 < 2:24.1.8-1	2:24.1.8-1

CVSS provenance

nvdv3.16.1MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

osv6.1MEDIUM

vendor_debian6.1MEDIUM

vendor_redhat6.1MEDIUM

vendor_msrc5.5MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.