What is the CVSS score of CVE-2025-62231?

CVE-2025-62231 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2025-62231?

Within 24 hours: Inventory all RHEL systems running X.Org X server (check /usr/bin/X* presence and systemctl status display-manager); identify systems with local user access or remote desktop services enabled. Within 7 days: Apply Red Hat security updates (RHSA-2025:19432 through RHSA-2025:22055) corresponding to your RHEL major version via 'yum update xorg-x11-server' or equivalent; test in non-production first. Within 30 days: Verify patch deployment across all inventory via 'rpm -q xorg-x11-server' and document completion.

X Server CVE-2025-62231

HIGH

Integer Overflow or Wraparound (CWE-190)

2025-10-30 secalert@redhat.com

Buffer Overflow Integer Overflow IBM Debian Red Hat Aix Debian Linux Enterprise Linux Enterprise Linux Eus Enterprise Linux Update Services For Sap Solutions Vios X Server Xwayland X Org Enterprise Linux Aus Enterprise Linux Tus Enterprise Linux Els

7.3

CVSS 3.1 · Vendor: redhat

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Recon

Obtain local authenticated access
Delivery

Craft malicious Xkb compatibility map data
Exploit

Send overflow-triggering input to XkbSetCompatMap()
Install

Trigger unsigned short overflow
C2

Corrupt X server memory
Execute

Escalate privileges to X server effective user
Impact

Execute arbitrary code with elevated privileges

Vulnerability Assessment

Weakness	CWE CWE-190 ASVS 5.0 V15 - Secure Coding and Architecture Integer overflow checks MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires authenticated local access to a system running X.Org X server with the Xkb extension enabled (default configuration). Attacker must have valid user credentials with sufficient privileges to interact with the X server session (PR:L in CVSS vector indicates low-privilege user access is sufficient). The vulnerability is exploitable on default X.Org configurations without requiring non-standard features or specific deployment modes. Exploitation is limited to systems where X.Org X server is actively running; headless servers, Wayland-only systems, or environments without graphical display servers are not vulnerable. Does not require physical console access - remote authenticated users with X forwarding or VNC access can potentially exploit. No user interaction required beyond attacker's own authenticated session.
Impact	Real-world risk is moderate and environment-specific. CVSS 7.3 (High) reflects significant potential impact (confidentiality high, integrity low, availability high) but requires local authenticated access (AV:L/PR:L), substantially limiting attack surface compared to remote vulnerabilities. The low attack complexity (AC:L) and no user interaction required (UI:N) means exploitation is straightforward once local access is obtained. However, absence from CISA KEV catalog and lack of public POC references suggest this is not being actively exploited at scale. Primary risk exists in multi-user Linux systems, shared hosting environments, containerized workloads with X server access, or systems where attackers have already gained initial foothold via other vectors and seek privilege escalation. Single-user desktop systems face lower risk unless physical access or social engineering enables local authentication. The 15 Red Hat advisories indicate broad applicability across RHEL ecosystem versions 8.x through 9.x, including extended lifecycle and specialized variants, making patch prioritization important for enterprise Linux deployments. Organizations running headless servers without X.Org installed are not affected.
Exploit ScenarioDerived	An attacker with existing low-privilege local access (e.g., compromised application account, SSH access, or container escape) crafts malicious keyboard compatibility map data designed to trigger integer overflow in XkbSetCompatMap(). The attacker sends this data to the X server through the Xkb extension interface, causing unsigned short overflow during value calculation. The overflow corrupts memory within the X server process space, which runs with elevated privileges. The attacker leverages memory corruption to overwrite critical data structures or inject code execution, escalating privileges to the X server's effective user (typically root or equivalent). Successful exploitation grants system-level access for further lateral movement, data exfiltration, or persistence mechanisms.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 20, 2026

Local privilege escalation in X.Org X server's Xkb extension affects RHEL-family distributions, allowing authenticated users to corrupt memory or crash the X server via integer overflow in XkbSetCompatMap(). Attack requires local access with low-privilege credentials. EPSS data not available; no CISA KEV listing indicates targeted rather than widespread exploitation. Red Hat has released patches across multiple RHEL versions (RHSA-2025:19432 through RHSA-2025:22055).

RemediationAI

Apply vendor-released patches immediately for affected Red Hat Enterprise Linux systems via the appropriate RHSA advisory for your specific RHEL version and variant. Use yum or dnf package managers to update xorg-x11-server and related packages: 'sudo dnf update xorg-x11-server xorg-x11-server-common xorg-x11-server-Xwayland' (exact package names vary by advisory). Verify installed versions match patched releases specified in your applicable RHSA. For systems unable to patch immediately, implement compensating controls with understanding of operational impact: (1) Disable the Xkb extension by adding 'Option "XkbDisable" "true"' to X server configuration in /etc/X11/xorg.conf (WARNING: breaks keyboard functionality for most desktop environments; only viable for systems using alternative input methods or Wayland); (2) Restrict local user access to systems running X server through stricter authentication policies and account monitoring; (3) Deploy SELinux in enforcing mode to limit X server process privileges (already default on RHEL but verify with 'getenforce'); (4) Consider migrating to Wayland display server where applications support it, as Wayland architecture provides better privilege separation. For non-Red Hat distributions, consult your vendor's security advisories for X.Org X server updates. Headless servers without X.Org installed require no action.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability exists in the X Keyboard (Xkb) extension of the X.Org X server, a fundamental component of graphical Linux/Unix systems that manages keyboard mapping and input handling. The XkbSetCompatMap() function performs insufficient bounds checking on input data before arithmetic operations, triggering CWE-190 (Integer Overflow or Wraparound). When processing specially crafted compatibility map data, an unsigned short variable can overflow during value calculation, resulting in an out-of-bounds write condition. The Xkb extension runs with elevated privileges in the X server process, making memory corruption exploitable for privilege escalation. This affects the core xorg-x11-server package across Red Hat Enterprise Linux variants, including standard RHEL, extended lifecycle releases, and specialized distributions like RHEL for Real Time and SAP Solutions.

Know when X Server gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 7.3 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

SUSE HIGH

Red Hat 7.3 MEDIUM

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

High

DescriptionCVE.org

A flaw was identified in the X.Org X server’s X Keyboard (Xkb) extension where improper bounds checking in the XkbSetCompatMap() function can cause an unsigned short overflow. If an attacker sends specially crafted input data, the value calculation may overflow, leading to memory corruption or a crash.

Executive ViewAI

Why It Matters

CVE-2025-62231 is a local privilege escalation vulnerability in the X.Org X server's keyboard extension that affects Red Hat Enterprise Linux systems, enabling low-privilege local users to crash or corrupt the X server through an integer overflow attack. Organizations running RHEL-family distributions with multiple users or remote desktop services should prioritize patching to prevent service disruption and potential privilege escalation chains on affected systems.

Business Impact: High

Compensating Controls

Vendor-released patch: Red Hat RHSA-2025:19432 through RHSA-2025:22055 (RHEL version-specific). If patch deployment is delayed, restrict local system access to trusted users only, disable remote desktop services (disable display-manager if not needed), and implement OS-level access controls to limit exposure to low-privilege user accounts.

Threat Intelligence Overview

EPSS Score

0.0%

Top 98% exploitable

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +36

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Integer Overflow MEDIUM

Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.

Affected Products (CPE)CVE.org

cpe:2.3:a:x.org:x_server:*:*:*:*:*:*:*:*

cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:*

cpe:2.3:a:ibm:vios:*:*:*:*:*:*:*:*

cpe:2.3:a:ibm:vios:4.1.2.0:*:*:*:*:*:*:*

cpe:2.3:o:ibm:aix:*:*:*:*:*:*:*:*

cpe:2.3:o:ibm:aix:7.3.4:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_aus:8.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_aus:8.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_aus:8.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_els:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_els:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:9.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_tus:8.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_tus:8.8:*:*:*:*:*:*:*

+ 4 more

More in X Server

View all

CVE-2018-14665 MEDIUM This Month POC

6.6 Oct 25

A flaw was found in xorg-x11-server before 1.20.3. Rated medium severity (CVSS 6.6), this vulnerability is low attack co

CVE-2019-17624 HIGH This Week POC

7.8 Oct 16

"" In X.Org X Server 1.20.4, there is a stack-based buffer overflow in the function XQueryKeymap. Rated high severity (C

CVE-2023-6816 CRITICAL Act Now

9.8 Jan 18

A heap overflow vulnerability exists in X.Org Server and Xwayland where improper memory allocation for logical button ma

CVE-2017-10971 HIGH This Week

8.8 Jul 06

In the X.Org X server before 2017-06-19, a user authenticated to an X Session could crash or execute code in the context

CVE-2026-56000 CRITICAL Act Now

9.0 Jul 08

Use-after-free in the GLX dispatch layer of X.Org X Server and Xwayland allows an authenticated X client to corrupt heap

CVE-2022-46344 HIGH This Week

8.8 Dec 14