Skip to main content

X.Org X Server CVE-2026-50263

| EUVDEUVD-2026-34820 MEDIUM
Use After Free (CWE-416)
2026-06-05 redhat GHSA-4ph5-83mw-vm42
5.5
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

2
Analysis Generated
Jun 05, 2026 - 12:20 vuln.today
CVE Published
Jun 05, 2026 - 10:36 nvd
MEDIUM 5.5

DescriptionCVE.org

A use-after-free flaw was found in the X.Org X server and Xwayland in CreateSaverWindow(). A client can trigger a use-after-free read after changing window attributes and forcing the screen saver, leading to information disclosure.

AnalysisAI

Use-after-free read in X.Org X server and Xwayland's CreateSaverWindow() function exposes heap memory to local authenticated users, resulting in information disclosure. A low-privileged local X client can manipulate window attributes and force screen saver activation to trigger a read from freed memory, leaking potentially sensitive heap contents (C:H/I:N/A:N). No public exploit identified at time of analysis, and this vulnerability is not listed in CISA KEV; however, an upstream fix commit has been published and a Red Hat advisory is available.

Technical ContextAI

The X.Org X server implements the X11 display protocol, with Xwayland serving as an X11 compatibility layer under Wayland compositors. CWE-416 (Use After Free) identifies the root cause: CreateSaverWindow(), the function responsible for creating the screen saver window resource, retains a reference to an object after it has been freed. When an X client sequence - changing window attributes followed by forcing screen saver activation - races or interacts with this lifecycle, the server performs a read on freed heap memory. Affected CPE strings (cpe:2.3:a:red_hat:red_hat_enterprise_linux_6 through _10) confirm the flaw is present across all currently supported and legacy RHEL releases, implicating both the packaged xorg-x11-server and xwayland components distributed by Red Hat. The freedesktop.org GitLab commit ecc634f1b2f7aa473d3a267eada98c4918bf9e05 represents the upstream patch to the shared xserver codebase.

RemediationAI

The primary fix is the upstream commit ecc634f1b2f7aa473d3a267eada98c4918bf9e05 to the xorg/xserver repository on freedesktop.org GitLab; a tagged release version incorporating this fix is not independently confirmed from the provided data, so administrators should monitor the xorg-announce mailing list post at https://lists.x.org/archives/xorg-announce/2026-June/003702.html for an official release announcement. Red Hat users should apply updated xorg-x11-server and xwayland packages once they are published via Red Hat Errata - track the advisory at https://access.redhat.com/security/cve/CVE-2026-50263. As a compensating control, restricting X server access to trusted local users only (e.g., via xhost restrictions or mandatory access controls such as SELinux) reduces the attack surface by limiting which processes can open X client connections; note that this does not eliminate the flaw but raises the privilege bar for exploitation. Disabling the screen saver entirely (e.g., via xset s off) may prevent the triggering condition but has not been confirmed as a complete mitigation by the vendor and could have usability side effects.

CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h

CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft

CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-28369 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel

CVE-2026-28368 CRITICAL
9.1 Mar 27

HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls

CVE-2026-33845 CRITICAL
9.1 Apr 30

Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege

CVE-2026-28367 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator

CVE-2026-16526 HIGH
8.8 Jul 30

Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe

CVE-2026-11610 HIGH
8.8 Jul 07

Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD

CVE-2026-14474 HIGH
8.8 Jul 07

Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user

CVE-2026-52720 HIGH
8.8 Jun 15

Heap buffer overflow in GStreamer's librfb (RFB/VNC client) allows a malicious VNC server to corrupt heap memory on a co

CVE-2026-59851 HIGH
8.8 Jul 21

Privilege escalation via authentication bypass in libssh affects servers that enable GSSAPIKeyExchange, where the gssapi

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Affected

Share

CVE-2026-50263 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy