---
id: CVE-2025-49180
title: >-
  A flaw was found in the RandR extension, where the RRChangeProviderProperty
  function does not properly validate input
summary: >-
  A flaw was found in the RandR extension, where the RRChangeProviderProperty
  function does not properly validate input. This issue leads to an integer
  overflow when computing the total size to allocate.
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-190
published: '2025-06-17'
updated: '2026-06-25'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-49180'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2025:10258'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:10342'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:10343'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:10344'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:10346'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:10347'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:10348'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:10349'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:10350'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:10351'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:10352'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:10355'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:10356'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:10360'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:10370'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:10374'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:10375'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:10376'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:10377'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:10378'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:10381'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:10410'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:9303'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:9304'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:9305'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:9306'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:9392'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:9964'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/security/cve/CVE-2025-49180'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2369981'
    label: secalert@redhat.com
  - url: >-
      https://gitlab.freedesktop.org/xorg/xserver/-/commit/3c3a4b767b16174d3213055947ea7f4f88e10ec6
    label: secalert@redhat.com
  - url: 'https://lists.debian.org/debian-lts-announce/2025/06/msg00028.html'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.00324
epssPercentile: 0.22762
ingestedAt: '2026-06-29T13:24:34.380Z'
---

## Overview

A flaw was found in the RandR extension, where the RRChangeProviderProperty function does not properly validate input. This issue leads to an integer overflow when computing the total size to allocate.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.