High
Xorg: xmayland: value overflow in xkbsetcompatmap()
Type: advisorySources: OSV
A flaw was identified in the X.Org X server’s X Keyboard (Xkb) extension where improper bounds checking in the XkbSetCompatMap() function can cause an unsigned short overflow. If an attacker sends specially crafted input data, the value calculation may overflow, leading to memory corruption or a crash.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2025-62231
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 05:54 UTC · Revision 1
Source evidence
Xorg: xmayland: value overflow in xkbsetcompatmap()
core-osv · Original sourcePublished 30 Oct 2025, 05:08 UTC
A flaw was identified in the X.Org X server’s X Keyboard (Xkb) extension where improper bounds checking in the XkbSetCompatMap() function can cause an unsigned short overflow. If an attacker sends specially crafted input data, the value calculation may overflow, leading to memory corruption or a crash.
osv:CVE-2025-62231
Complete source record
{
"id": "e7fe96c64904de2fac6800bddedf497fa1ff49e1134176bef371fdd6325ce104",
"url": "https://osv.dev/vulnerability/CVE-2025-62231",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Xorg: xmayland: value overflow in xkbsetcompatmap()",
"summary": "A flaw was identified in the X.Org X server’s X Keyboard (Xkb) extension where improper bounds checking in the XkbSetCompatMap() function can cause an unsigned short overflow. If an attacker sends specially crafted input data, the value calculation may overflow, leading to memory corruption or a crash.",
"evidence": "osv:CVE-2025-62231",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2025-62231",
"aliases": [
"CVE-2025-62231"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://gitlab.freedesktop.org/xorg/xserver",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "65acc54b7079ad4c01c35ebdde34b3ff9ebd0d2a"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "24.1.9"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
}
}
],
"versions": [
"xwayland-24.1.8",
"xwayland-24.1.7",
"xwayland-24.1.6",
"xwayland-24.1.5",
"xwayland-24.1.4",
"xwayland-24.1.3",
"xwayland-24.1.2",
"xwayland-24.1.1",
"xwayland-24.1.0",
"xwayland-24.0.99.902",
"xwayland-24.0.99.901",
"xorg-server-21.0.99.1",
"xorg-server-1.20.0",
"xorg-server-1.19.99.905",
"xorg-server-1.19.99.904",
"xorg-server-1.19.99.903",
"xorg-server-1.19.99.902",
"xorg-server-1.19.99.901",
"xorg-server-1.19.0",
"xorg-server-1.18.99.902",
"xorg-server-1.18.99.901",
"xorg-server-1.18.99.2",
"xorg-server-1.18.0",
"xorg-server-1.17.99.902",
"xorg-server-1.17.99.901",
"xorg-server-1.17.0",
"xorg-server-1.16.99.902",
"xorg-server-1.16.99.901",
"xorg-server-1.16.0",
"xorg-server-1.15.99.904",
"xorg-server-1.15.99.903",
"xorg-server-1.15.99.902",
"xorg-server-1.15.99.901",
"xorg-server-1.15.0",
"xorg-server-1.14.99.905",
"xorg-server-1.14.99.904",
"xorg-server-1.14.99.903",
"xorg-server-1.14.99.902",
"xorg-server-1.14.99.901",
"xorg-server-1.14.99.3",
"xorg-server-1.14.99.2",
"xorg-server-1.14.99.1",
"xorg-server-1.14.0",
"xorg-server-1.13.99.902",
"xorg-server-1.13.99.901",
"xorg-server-1.13.0",
"xorg-server-1.12.99.905",
"xorg-server-1.12.99.904",
"xorg-server-1.12.99.903",
"xorg-server-1.12.99.902",
"xorg-server-1.12.99.901",
"xorg-server-1.12.0",
"xorg-server-1.11.99.903",
"xorg-server-1.11.99.902",
"xorg-server-1.11.99.901",
"xorg-server-1.11.99.1",
"xorg-server-1.11.0",
"xorg-server-1.10.99.902",
"xorg-server-1.10.99.901",
"xorg-server-1.10.0",
"xorg-server-1.9.99.903",
"xorg-server-1.9.99.902",
"xorg-server-1.9.99.901",
"xorg-server-1.9.0",
"xorg-server-1.8.99.906",
"xorg-server-1.8.99.905",
"xorg-server-1.8.99.904",
"xorg-server-1.8.99.903",
"xorg-server-1.8.99.902",
"xorg-server-1.8.99.901",
"xorg-server-1.8.0",
"xorg-server-1.7.99.902",
"xorg-server-1.7.99.901",
"xorg-server-1.7.99.2",
"xorg-server-1.7.99.1",
"xorg-server-1.6.99.901",
"xorg-server-1.6.99.900",
"xorg-server-1.5.99.1",
"xorg-server-1.1.99.3",
"xorg-server-1_1_99_2",
"xorg-server-1_0_99_901",
"XORG-7_0_99_901",
"xorg-server-1_1_99_1",
"xorg-server-1_0_99_2",
"xorg-server-1_0_99_1",
"XORG-7_0",
"pre-xgldrop-merge",
"XORG-6_99_99_904",
"MODULAR_COPY",
"XORG-6_99_99_903",
"XORG-6_8_99_903",
"DRM-2_0_0",
"XORG-6_99_99_902",
"XORG-6_8_99_902",
"DRM-1_0_5",
"XORG-6_99_99_901",
"XORG-6_8_99_901",
"DRM-20051017",
"kdrive-initial-import",
"xorg-server-0_99_1",
"XORG-6_99_99_900",
"XORG-6_8_99_900",
"XORG-6_8_99_16",
"XORG-6_8_99_15",
"XORG-6_8_99_14",
"XORG-6_8_99_13",
"XORG-6_8_99_12",
"DRM-20050615",
"sco_port_update-base",
"XORG-6_8_99_11",
"XORG-6_8_99_10",
"XORG-6_8_99_9",
"XORG-6_8_99_8",
"XORG-6_8_99_7",
"XORG-6_8_99_6",
"XORG-6_8_99_5",
"XORG-6_8_99_4",
"XORG-6_8_99_3",
"XORG-6_8_99_2",
"XORG-6_8_99_1",
"lg3d-base",
"XORG-6_8_0",
"XORG-6_7_99_904",
"XORG-6_7_99_903",
"XORG-6_7_99_902",
"XORG-6_7_99_901",
"XORG-6_7_99_2",
"XORG-6_7_99_1",
"DRM-20040721",
"DRI-trunk-20040721",
"DRI-trunk-20040613",
"DRI-XFree86-4_3_99_12-merge",
"DRM-20040613",
"XACE-SELINUX-MERGE",
"xf86-4_4_99_1",
"xf86-4_4_0",
"xf86-4_3_99_903",
"xf86-4_3_99_903_special",
"add-Xi",
"xf86-012804-2330",
"xf86-4_3_99_902",
"xf86-4_3_99_901",
"dri-0-1-branchpoint",
"xf86-4_3_99_16",
"xf86-4_3_0_1",
"PRE_xf86-4_3_0_1",
"XORG-MAIN",
"xfixes_2_branchpoint",
"keithp",
"xf-4_3_99_6",
"xf-4_3_99_5",
"xf-4_3_99_4",
"xf-4_3_99_3",
"xf-4_3_99_2",
"xf-4_3_99_1",
"xf-4_3_0_1",
"xf-4_3_0",
"xf-4_2_99_902",
"xf-4_2_99_901",
"xf-4_2_99_4",
"xf-4_2_99_3",
"ah-20021030-postdri",
"xf-4_2_99_2",
"ah-20021030",
"dhd-20020916",
"xf-4_2_99_1",
"dri-20020222-merge",
"before-mesa-4_0-import",
"dri-20020129-merge",
"xf-4_2_1_1",
"xf-4_2_1",
"xf-4_2_0_1",
"xf-4_2_0-bindist-1",
"xf-4_2_0-bindist",
"xf-4_2_0",
"xf-4_2-bp",
"xf-4_1_99_7",
"xf-4_1_99_6",
"xf-4_1_99_5",
"xf-4_1_99_4",
"Domain-sync4",
"Domain-sync3",
"xf-4_1_99_3",
"xf-4_1_99_2",
"Domain-sync2",
"Domain-sync1",
"Domain-base",
"xf-4_1_99_1",
"dhd-20010817",
"xf-4_0_99_900",
"xf-4_0_99_3",
"xf-4_0_99_2",
"dhd-20010328",
"xf-4_0_99_1",
"xf-4_0_2-bindist",
"xf-4_0_2",
"xf-4_0_1Zc",
"xf-4_0_1Zb",
"pre-R651-import",
"xf-4_0_1Za",
"xf-4_0_1Z",
"xf-4_0_1h",
"xf-4_0_1g",
"xf-4_0_1f",
"xf-4_0_1e",
"xf-4_0_1d",
"xf-4_0_1c",
"xf-4_0_1b",
"xf-4_0g",
"xf-4_0f",
"xf-4_0e",
"xf-4_0d",
"xf-4_0c",
"xf-4_0_1a",
"xf-4_0_1-bindist",
"xf-4_0_1",
"xf-4_0Z",
"xf-4_0b",
"xf-4_0a",
"xf-4_0-bindist",
"xf-4_0",
"xf-3_9_18b",
"xf-3_9_18a",
"xf-3_9_18Za",
"xf-3_9_18Z",
"xf-3_9_18",
"xf-3_9_17f",
"xf-3_9_17e",
"xf-3_9_17d",
"xf-3_9_17c",
"xf-3_9_17b",
"xf-3_9_17a",
"xf-3_9_17Z",
"xf-3_9_17",
"xf-3_9_16Za",
"xf-3_9_16f",
"xf-3_9_16e",
"xf-3_9_16d",
"xf-3_9_16Z"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-62231.json"
}
}
],
"modified": "2026-10-28T02:30:26.116572379Z",
"provider": "osv",
"references": [
"https://access.redhat.com/downloads/content/package-browser/",
"https://lists.debian.org/debian-lts-announce/2025/10/msg00033.html",
"https://lists.x.org/archives/xorg-announce/2025-October/003635.html",
"https://access.redhat.com/errata/RHSA-2025:19432",
"https://access.redhat.com/errata/RHSA-2025:19433",
"https://access.redhat.com/errata/RHSA-2025:19434",
"https://access.redhat.com/errata/RHSA-2025:19435",
"https://access.redhat.com/errata/RHSA-2025:19489",
"https://access.redhat.com/errata/RHSA-2025:19623",
"https://access.redhat.com/errata/RHSA-2025:19909",
"https://access.redhat.com/errata/RHSA-2025:20958",
"https://access.redhat.com/errata/RHSA-2025:20960",
"https://access.redhat.com/errata/RHSA-2025:20961",
"https://access.redhat.com/errata/RHSA-2025:21035",
"https://access.redhat.com/errata/RHSA-2025:22040",
"https://access.redhat.com/errata/RHSA-2025:22041",
"https://access.redhat.com/errata/RHSA-2025:22051",
"https://access.redhat.com/errata/RHSA-2025:22055",
"https://access.redhat.com/errata/RHSA-2025:22056",
"https://access.redhat.com/errata/RHSA-2025:22077",
"https://access.redhat.com/errata/RHSA-2025:22096",
"https://access.redhat.com/errata/RHSA-2025:22164",
"https://access.redhat.com/errata/RHSA-2025:22167",
"https://access.redhat.com/errata/RHSA-2025:22364",
"https://access.redhat.com/errata/RHSA-2025:22365",
"https://access.redhat.com/errata/RHSA-2025:22426",
"https://access.redhat.com/errata/RHSA-2025:22427",
"https://access.redhat.com/errata/RHSA-2025:22667",
"https://access.redhat.com/errata/RHSA-2025:22729",
"https://access.redhat.com/errata/RHSA-2025:22742",
"https://access.redhat.com/errata/RHSA-2025:22753",
"https://access.redhat.com/errata/RHSA-2026:0031",
"https://access.redhat.com/errata/RHSA-2026:0033",
"https://access.redhat.com/errata/RHSA-2026:0034",
"https://access.redhat.com/errata/RHSA-2026:0035",
"https://access.redhat.com/errata/RHSA-2026:0036",
"https://access.redhat.com/security/cve/CVE-2025-62231",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62231.json",
"https://nvd.nist.gov/vuln/detail/CVE-2025-62231",
"https://bugzilla.redhat.com/show_bug.cgi?id=2402660",
"https://gitlab.freedesktop.org/xorg/xserver"
],
"provider_metadata": {
"cwe_ids": [
"CWE-190"
],
"cna_assigner": "redhat",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"fixed": "0:24.1.5-5.el10_0"
},
{
"fixed": "0:24.1.5-5.el10_1"
},
{
"fixed": "0:1.1.0-25.el6_10.15"
},
{
"fixed": "0:1.20.4-33.el7_9"
},
{
"fixed": "0:1.8.0-36.el7_9.3"
},
{
"fixed": "0:21.1.3-19.el8_10"
},
{
"fixed": "0:1.20.11-27.el8_10"
},
{
"fixed": "0:1.15.0-8.el8_10"
},
{
"fixed": "0:1.9.0-15.el8_2.15"
},
{
"fixed": "0:1.20.6-5.el8_2"
},
{
"fixed": "0:1.11.0-8.el8_4.14"
},
{
"fixed": "0:1.20.10-3.el8_4"
},
{
"fixed": "0:1.11.0-8.el8_4.14"
},
{
"fixed": "0:1.20.10-3.el8_4"
},
{
"fixed": "0:1.12.0-6.el8_6.15"
},
{
"fixed": "0:1.20.11-6.el8_6"
},
{
"fixed": "0:21.1.3-2.el8_6.5"
},
{
"fixed": "0:1.12.0-6.el8_6.15"
},
{
"fixed": "0:1.20.11-6.el8_6"
},
{
"fixed": "0:21.1.3-2.el8_6.5"
},
{
"fixed": "0:1.12.0-6.el8_6.15"
},
{
"fixed": "0:1.20.11-6.el8_6"
},
{
"fixed": "0:21.1.3-2.el8_6.5"
},
{
"fixed": "0:1.12.0-15.el8_8.16"
},
{
"fixed": "0:1.20.11-17.el8_8"
},
{
"fixed": "0:21.1.3-12.el8_8"
},
{
"fixed": "0:1.12.0-15.el8_8.16"
},
{
"fixed": "0:1.20.11-17.el8_8"
},
{
"fixed": "0:21.1.3-12.el8_8"
},
{
"fixed": "0:1.20.11-32.el9_6"
},
{
"fixed": "0:1.14.1-9.el9_6"
},
{
"fixed": "0:23.2.7-5.el9_6"
},
{
"fixed": "0:1.15.0-6.el9_7"
},
{
"fixed": "0:23.2.7-5.el9_7"
},
{
"fixed": "0:1.20.11-32.el9_7"
},
{
"fixed": "0:1.11.0-22.el9_0.16"
},
{
"fixed": "0:1.20.11-12.el9_0"
},
{
"fixed": "0:21.1.3-4.el9_0"
},
{
"fixed": "0:1.12.0-14.el9_2.13"
},
{
"fixed": "0:1.20.11-19.el9_2"
},
{
"fixed": "0:21.1.3-9.el9_2"
},
{
"fixed": "0:1.13.1-8.el9_4.8"
},
{
"fixed": "0:1.20.11-27.el9_4"
},
{
"fixed": "0:22.1.9-7.el9_4"
}
],
"source": "AFFECTED_FIELD",
"strategy": "InverseAffectedRanges"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62231.json"
}
},
"related_cves": [
{
"value": "CVE-2025-62231",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 492887,
"published_at": "2025-10-30T05:08:32.155+00:00"
}