CVE-2025-62231
highA flaw was identified in the X.Org X server’s X Keyboard (Xkb) extension where improper bounds checking in the XkbSetCompatMap() function can cause an unsigned…
Vendor / product: X.org — x server
A flaw was identified in the X.Org X server’s X Keyboard (Xkb) extension where improper bounds checking in the XkbSetCompatMap() function can cause an unsigned short overflow. If an attacker sends specially crafted input data, the value calculation may overflow, leading to memory corruption or a crash.
CVSS
7.3
7.3 (CVSS v3.1)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H Severity source: NVD CVSS v3.1 (secalert@redhat.com)
Timeline (UTC)
Published: 2025-10-30 05:15
Modified: 2026-11-05 17:17
NVD status: Analyzed
Last synced 9 hours ago
Verified against the source API 2026-11-05 17:18 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
x.org / x_server <21.1.19
x.org / xwayland <24.1.9
ibm / vios ≥4.1.0 <4.1.1.30, 4.1.2.0
ibm / aix ≥7.2.5 <7.2.5.12, ≥7.3.2 <7.3.3.3, 7.3.4
debian / debian_linux 11.0
redhat / enterprise_linux 8.0, 9.0, 10.0
redhat / enterprise_linux_aus 8.2, 8.4, 8.6
redhat / enterprise_linux_els 6.0, 7.0
redhat / enterprise_linux_eus 8.4, 9.4
redhat / enterprise_linux_tus 8.6, 8.8
redhat / enterprise_linux_update_services_for_sap_solutions 8.6, 8.8, 9.0, 9.2
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Vendor advisory: https://lists.x.org/archives/xorg-announce/2025-October/003635.html
Patch / mitigation: http://www.openwall.com/lists/oss-security/2025/10/28/7
References
- https://access.redhat.com/errata/RHSA-2025:19432 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2025:19433 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2025:19434 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2025:19435 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2025:19489 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2025:19623 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2025:19909 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2025:20958 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2025:20960 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2025:20961 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2025:21035 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2025:22040 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2025:22041 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2025:22051 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2025:22055 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2025:22056 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2025:22077 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2025:22096 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2025:22164 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2025:22167 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2025:22364 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2025:22365 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2025:22426 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2025:22427 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2025:22667 secalert@redhat.com
Data sources
NVD CVE API 2.0 — fetched 2026-11-05 17:18 UTC · record ↗