CVE-2025-62231: Debian Linux

High severity, CVSS 7.3. EPSS: 0.3% chance of exploitation in the next 30 days.

A flaw was identified in the X.Org X server’s X Keyboard (Xkb) extension where improper bounds checking in the XkbSetCompatMap() function can cause an unsigned short overflow. If an attacker sends specially crafted input data, the value calculation may overflow, leading to memory corruption or a crash.

Affected products

• Debian Debian Linux: version 11.0 only
• IBM Aix: from 7.2.5, before 7.2.5.12 (fixed in 7.2.5.12); from 7.3.2, before 7.3.3.3 (fixed in 7.3.3.3); version 7.3.4 only
• IBM Vios: from 4.1.0, before 4.1.1.30 (fixed in 4.1.1.30); version 4.1.2.0 only
• Red Hat Enterprise Linux: version 8.0 only; version 9.0 only; version 10.0 only
• Red Hat Enterprise Linux Aus: version 8.2 only; version 8.4 only; version 8.6 only
• Red Hat Enterprise Linux Els: version 6.0 only; version 7.0 only
• Red Hat Enterprise Linux Eus: version 8.4 only; version 9.4 only
• Red Hat Enterprise Linux Tus: version 8.6 only; version 8.8 only
• Red Hat Enterprise Linux Update Services For SAP Solutions: version 8.6 only; version 8.8 only; version 9.0 only; version 9.2 only
• X.org X Server: before 21.1.19 (fixed in 21.1.19)
• X.org Xwayland: before 24.1.9 (fixed in 24.1.9)

Published 2025-10-30. Last modified 2026-07-01.