CVE-2025-49177: Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: data leak in xfixes extension's xfixessetclientdisconnectmode
A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests.
Other sources
Information Disclosure vulnerability in the XFIXES extension. Lack of request length validation in XFixesSetClientDisconnectMode allows clients to read residual data from previous requests.
— Red Hat
Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: data leak in xfixes extension's xfixessetclientdisconnectmode
— Microsoft
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-49177?
CVE-2025-49177 is classified with a high severity due to its potential for information disclosure.
How do I fix CVE-2025-49177?
To fix CVE-2025-49177, update to the latest version of the affected software that addresses this vulnerability.
What products are affected by CVE-2025-49177?
CVE-2025-49177 affects the X.Org xorg-x11-server, XFIXES extension, and TigerVNC tigervnc.
What type of vulnerability is CVE-2025-49177?
CVE-2025-49177 is an information disclosure vulnerability that arises from a lack of request length validation.
How can CVE-2025-49177 impact my system?
CVE-2025-49177 can allow an attacker to read unintended memory, potentially exposing sensitive information from previous requests.