EUVD-2025-18503
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Lifecycle Timeline
4Description
A flaw was found in the Big Requests extension. The request length is multiplied by 4 before checking against the maximum allowed size, potentially causing an integer overflow and bypassing the size check.
Analysis
CVE-2025-49176 is an integer overflow vulnerability in the X11 Big Requests extension that allows local attackers with low privileges to bypass request size validation by triggering a multiplication-based integer wrap-around, enabling denial of service or potential code execution through oversized X protocol requests. The vulnerability affects X11 server implementations that use the Big Requests extension; while not currently listed in CISA KEV catalog, the 7.3 CVSS score and local attack vector indicate moderate-to-high real-world risk for multi-user systems. No public POC or active exploitation has been confirmed at time of analysis.
Technical Context
The Big Requests extension (part of X11/Xorg protocol stack) extends the maximum request size limit for X protocol communication beyond the standard 262,144-byte limit. The vulnerability exists in the request size validation logic, where the request length parameter is multiplied by 4 before comparison against a configured maximum size threshold—a common pattern for converting byte counts to word counts in X protocol processing. This multiplication (CWE-190: Integer Overflow or Wraparound) can cause the 32-bit integer to wrap around, resulting in a small value that passes the size check despite the original request being much larger. Affected components include Xorg server implementations and X11 protocol libraries that implement the Big Requests extension (BIGREQ extension). The root cause is improper input validation prior to arithmetic operations on untrusted client-supplied values.
Affected Products
Xorg X Server versions prior to the patch release (specific version not provided in available data; typically affects stable branches 21.1.x and earlier). X11 protocol implementations and client libraries using the Big Requests extension across Linux distributions. CPE data would typically be: cpe:2.3:a:x.org:xorg-server:*:*:*:*:*:*:*:* (version range TBD pending vendor advisory). Affected configurations include: (1) Linux systems running Xorg with Big Requests extension enabled (enabled by default in most distributions), (2) Multi-user shared systems, containers, or cloud instances where unprivileged users can initiate X connections, (3) Thin client or terminal server environments. Specific vendor-affected distributions likely include Debian, Ubuntu, Fedora, Red Hat Enterprise Linux, openSUSE, and Arch Linux—consult respective security advisories for patched versions.
Remediation
Immediate: (1) Update Xorg X Server to the patched version (version number pending—check security advisories from Xorg, Debian, Red Hat, and Ubuntu); (2) Verify Big Requests extension is patched via 'Xvfb -version' or 'grep -i bigreq' on running X servers. Short-term mitigation: (1) Disable Big Requests extension if not required by applications (uncommon configuration), (2) Restrict local X access via xhost controls or by limiting users with X session access, (3) Use authentication mechanisms like MIT-MAGIC-COOKIE or X11 socket permissions to limit client connections. Long-term: (1) Enable SELinux or AppArmor profiles to restrict X server process capabilities, (2) Run X server in containerized/sandboxed environments with reduced privileges, (3) Apply principle of least privilege for local user accounts. Patch availability: Check Xorg security advisories, RHEL/CentOS updates via 'yum update xorg-x11-server', Debian/Ubuntu via 'apt update && apt upgrade xorg-server', and respective CVE tracker pages for each distribution.
Priority Score
Vendor Status
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| jammy | released | 2:21.1.4-2ubuntu1.7~22.04.15 |
| noble | released | 2:21.1.12-1ubuntu1.4 |
| oracular | released | 2:21.1.13-2ubuntu1.4 |
| plucky | released | 2:21.1.16-1ubuntu1.1 |
| trusty | needs-triage | - |
| upstream | released | 21.1.17 |
| bionic | released | 2:1.19.6-1ubuntu4.15+esm13 |
| focal | released | 2:1.20.13-1ubuntu1~20.04.20+esm1 |
| xenial | released | 2:1.18.4-0ubuntu0.12+esm18 |
| questing | released | 2:21.1.18-1ubuntu1 |
| Release | Status | Version |
|---|---|---|
| jammy | released | 2:22.1.1-1ubuntu0.19 |
| noble | released | 2:23.2.6-1ubuntu0.6 |
| oracular | released | 2:24.1.2-1ubuntu0.6 |
| plucky | released | 2:24.1.6-1ubuntu0.1 |
| upstream | released | 24.1.7 |
| questing | released | 2:24.1.6-1ubuntu1 |
| Release | Status | Version |
|---|---|---|
| plucky | DNE | - |
| xenial | not-affected | code not present |
| jammy | DNE | - |
| noble | DNE | - |
| oracular | DNE | - |
| upstream | not-affected | - |
| questing | DNE | - |
| Release | Status | Version |
|---|---|---|
| xenial | not-affected | code not present |
| bionic | not-affected | code not present |
| focal | not-affected | code not present |
| jammy | not-affected | code not present |
| noble | not-affected | code not present |
| oracular | not-affected | code not present |
| plucky | not-affected | code not present |
| upstream | not-affected | - |
| questing | not-affected | code not present |
| Release | Status | Version |
|---|---|---|
| jammy | DNE | - |
| noble | DNE | - |
| oracular | DNE | - |
| plucky | DNE | - |
| upstream | needs-triage | - |
| xenial | released | 2:1.19.6-1ubuntu4.1~16.04.6+esm10 |
| questing | DNE | - |
| Release | Status | Version |
|---|---|---|
| jammy | DNE | - |
| noble | DNE | - |
| oracular | DNE | - |
| plucky | DNE | - |
| upstream | needs-triage | - |
| bionic | released | 2:1.20.8-2ubuntu2.2~18.04.11+esm5 |
| questing | DNE | - |
| Release | Status | Version |
|---|---|---|
| bionic | not-affected | code not present |
| jammy | DNE | - |
| noble | DNE | - |
| oracular | DNE | - |
| plucky | DNE | - |
| upstream | not-affected | - |
| questing | DNE | - |
Debian
Bug #1108073| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | fixed | 2:1.20.11-1+deb11u16 | - |
| bullseye (security) | fixed | 2:1.20.11-1+deb11u17 | - |
| bookworm, bookworm (security) | fixed | 2:21.1.7-3+deb12u11 | - |
| trixie (security), trixie | fixed | 2:21.1.16-1.3+deb13u1 | - |
| forky, sid | fixed | 2:21.1.21-1 | - |
| bookworm | fixed | 2:21.1.7-3+deb12u10 | - |
| (unstable) | fixed | 2:21.1.16-1.3 | - |
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bookworm | vulnerable | 2:22.1.9-1 | - |
| trixie | vulnerable | 2:24.1.6-1 | - |
| forky, sid | fixed | 2:24.1.9-1 | - |
| (unstable) | fixed | 2:24.1.8-1 | - |
Share
External POC / Exploit Code
Leaving vuln.today