CVE-2025-62231

EUVD-2025-36898
A flaw was identified in the X.Org X server’s X Keyboard (Xkb) extension where improper bounds checking in the XkbSetCompatMap() function can cause an unsigned short overflow. If an attacker sends specially crafted input data, the value calculation may overflow, leading to memory corruption or a crash.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.3 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
redhatCNA
7.3 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 1%
Debian logo
Debian Releases
Debian Product
Codename
xorg-server
bookworm
2:21.1.7-3+deb12u11
ignored
bookworm (security)
2:21.1.7-3+deb12u11
fixed
bullseye
vulnerable
bullseye (security)
2:1.20.11-1+deb11u17
fixed
forky
2:21.1.21-1
fixed
sid
2:21.1.21-1
fixed
trixie
2:21.1.16-1.3+deb13u1
ignored
trixie (security)
2:21.1.16-1.3+deb13u1
fixed
xwayland
bookworm
ignored
forky
2:24.1.9-1
fixed
sid
2:24.1.9-1
fixed
trixie
ignored
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
xorg
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
not-affected
plucky
not-affected
questing
not-affected
xenial
not-affected
xorg-server
bionic
needs-triage
focal
needs-triage
jammy
Fixed 2:21.1.4-2ubuntu1.7~22.04.16
released
noble
Fixed 2:21.1.12-1ubuntu1.5
released
plucky
Fixed 2:21.1.16-1ubuntu1.2
released
questing
Fixed 2:21.1.18-1ubuntu1.1
released
trusty
needs-triage
xenial
needs-triage
xwayland
jammy
Fixed 2:22.1.1-1ubuntu0.20
released
noble
Fixed 2:23.2.6-1ubuntu0.7
released
plucky
Fixed 2:24.1.6-1ubuntu0.2
released
questing
Fixed 2:24.1.6-1ubuntu1.1
released
xorg-server-hwe-16.04
jammy
dne
noble
dne
plucky
dne
questing
dne
xenial
needs-triage
xorg-server-hwe-18.04
bionic
needs-triage
jammy
dne
noble
dne
plucky
dne
questing
dne
xorg-hwe-16.04
jammy
dne
noble
dne
plucky
dne
questing
dne
xenial
not-affected
xorg-hwe-18.04
bionic
not-affected
jammy
dne
noble
dne
plucky
dne
questing
dne
References