Is CVE-2025-62231 being actively exploited?

CVE-2025-62231 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2025-62231?

CVE-2025-62231 has a CVSS 3.1 base score of 7.3 (HIGH).

CVE-2025-62231

HIGH · CVSS 7.3EPSS 0.3%EU EUVD

A flaw was identified in the X.Org X server’s X Keyboard (Xkb) extension where improper bounds checking in the XkbSetCompatMap() function can cause an unsigned short overflow. If an attacker sends specially crafted input data, the value calculation may overflow, leading to memory corruption or a crash.

Key facts

CVSS score: 7.3 (v3.1)
Severity: HIGH
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Weakness (CWE): CWE-190
EPSS score: 0.3% (21th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2025-36898)
Published: October 30, 2025
NVD last modified: July 1, 2026
Status: Analyzed

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2025-36898 in the EU Vulnerability Database. Last updated in EUVD on April 20, 2026.

View on the EU Vulnerability Database

Affected products

debian / debian linux
ibm / aix
ibm / aix
ibm / vios
ibm / vios
redhat / enterprise linux
redhat / enterprise linux
redhat / enterprise linux
redhat / enterprise linux aus
redhat / enterprise linux aus
redhat / enterprise linux aus
redhat / enterprise linux els
redhat / enterprise linux els
redhat / enterprise linux eus
redhat / enterprise linux eus
redhat / enterprise linux tus
redhat / enterprise linux tus
redhat / enterprise linux update services for sap solutions
redhat / enterprise linux update services for sap solutions
redhat / enterprise linux update services for sap solutions
redhat / enterprise linux update services for sap solutions
x.org / x server
x.org / xwayland

Certified products that may be affected

34 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

Red Hat Enterprise Linux 8 NSS Cryptographic Module - Red Hat, Inc. - FIPS 140 5513 - active
Red Hat Enterprise Linux 8 Kernel Cryptographic API - Red Hat, LLC - FIPS 140 5461 - active
Red Hat Enterprise Linux 9 Kernel Cryptographic API - Red Hat, Inc. - FIPS 140 5445 - active
Red Hat Enterprise Linux 9 libgcrypt - Red Hat, Inc. - FIPS 140 5366 - active
Red Hat Enterprise Linux 8 Kernel Cryptographic API - Red Hat, Inc. - FIPS 140 5089 - active

See all 34 in the Security Certifications Explorer.

References

http://www.openwall.com/lists/oss-security/2025/10/28/7(Mailing List, Patch)
https://access.redhat.com/errata/RHSA-2025:19432(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2025:19433(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2025:19434(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2025:19435(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2025:19489(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2025:19623(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2025:19909(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2025:20958(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2025:20960(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2025:20961(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2025:21035(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2025:22040(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2025:22041(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2025:22051(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2025:22055(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2025:22056(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2025:22077(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2025:22096(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2025:22164(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2025:22167(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2025:22364(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2025:22365(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2025:22426(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2025:22427(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2025:22667(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2025:22729(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2025:22742(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2025:22753(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2026:0031(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2026:0033(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2026:0034(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2026:0035(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2026:0036(Third Party Advisory)
https://access.redhat.com/security/cve/CVE-2025-62231(Third Party Advisory)
https://bugzilla.redhat.com/show_bug.cgi?id=2402660(Issue Tracking, Third Party Advisory)
https://lists.debian.org/debian-lts-announce/2025/10/msg00033.html(Mailing List, Third Party Advisory)
https://lists.x.org/archives/xorg-announce/2025-October/003635.html(Mailing List, Vendor Advisory)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain