What is the CVSS score of CVE-2026-56000?

CVE-2026-56000 has a CVSS 4.0 base score of 9.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-56000?

Within 24 hours: Inventory systems running X.Org X Server and Xwayland; document which systems expose X11 sockets to untrusted users or networks. Within 7 days: Restrict X11 socket access via permissions change (/tmp/.X11-unix); disable GLX extension via xorg.conf if operationally unnecessary; implement firewall rules to block TCP ports 6000-6063 where X11 network access is not required. Within 30 days: Monitor freedesktop.org and X.Org security advisories for vendor patch targeting GLX contextTags memory management; prepare and test patch deployment plan for immediate rollout when available.

X.Org X Server CVE-2026-56000

EUVD-2026-42202 CRITICAL

Use After Free (CWE-416)

2026-07-08

GHSA-4gcc-rqqq-58jp

Denial Of Service Use After Free Memory Corruption Red Hat X Server Xwayland Suse X Org

9.0

CVSS 4.0 · Vendor

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Recon

Obtain authorized X display connection with GLX support
Delivery

Create 16 GLX contexts via CreateContext requests
Exploit

Issue MakeCurrent(oldContextTag=0) for each to fill all tag slots
Install

Issue 17th MakeCurrent with non-zero oldContextTag
C2

Trigger GlxAllocContextTag realloc moving contextTags buffer
Execute

GlxFreeContextTag writes zeros to freed heap memory
Impact

Leverage heap corruption for privilege escalation

Vulnerability Assessment

Weakness	CWE CWE-416 ASVS 5.0 V15 - Secure Coding and Architecture Memory lifecycle management MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires an active, authorized connection to an X11 display that has GLX support enabled - the attacker must be able to create GLX rendering contexts via the X protocol. This typically means having local session access or an explicitly authorized remote X11 connection (XAUTHORITY cookie or xhost permission). GLX availability is standard on systems running X.Org with hardware OpenGL drivers. On Xwayland, the same GLX dispatch layer is present. The critical limiting factor is that vanilla xorg-server-21.1.16 reportedly does not exhibit the bug; only builds incorporating upstream commit 4781f2a5a8c2c2b000374e2d87982a6701d5a6b3 (whether on main branch or via distribution backport) are confirmed vulnerable. Authentication requirements are not derivable from a CVSS vector (none provided), but the description clearly implies an authenticated X client is required. The attack is limited to 34 X11 protocol requests from a single client connection, making it compact and potentially scriptable.
Impact	No CVSS vector, EPSS score, or CISA KEV entry is available for this CVE, which limits automated risk scoring. Based on the vulnerability mechanics, exploitation requires an authenticated X client connection with the ability to create GLX contexts, making mass remote exploitation unlikely without prior X display access. The attack sequence is deterministic and requires only 34 well-defined X11 protocol requests, meaning complexity is low for a sufficiently motivated attacker. Heap corruption via use-after-free at controlled offsets can be leveraged for privilege escalation or code execution within the X server process, which typically runs with elevated privileges. The affected code path (GLX) is widely enabled wherever hardware-accelerated OpenGL is used - essentially all modern Linux desktop environments. The ZDI discovery pipeline suggests the vulnerability has been assessed as potentially exploitable, but no public exploit or weaponized code has been identified at time of analysis. The conditional affected scope (requires a specific backported commit on 21.1.x, or the use of main/master branch builds) limits real-world exposure compared to a straightforward version-range flaw, and defenders should audit whether their distribution backported commit 4781f2a5a8c2c2b000374e2d87982a6701d5a6b3 before treating 21.1.x builds as safe.
Exploit ScenarioDerived	A local attacker with access to the X display - either directly on the machine or via an authorized remote X11 connection - connects as a GLX-capable client and issues 16 CreateContext calls followed by MakeCurrent(oldContextTag=0) for each, filling all 16 tag slots to capacity. A 17th MakeCurrent with a non-zero oldContextTag triggers GlxAllocContextTag() to realloc the contextTags array; if the allocator moves the buffer, oldTag is now dangling, and the ensuing GlxFreeContextTag(oldTag) writes controlled zeros into freed heap memory. Chaining this corruption with heap grooming techniques could enable local privilege escalation to the X server's privilege level.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 08, 2026

Use-after-free in the GLX dispatch layer of X.Org X Server and Xwayland allows an authenticated X client to corrupt heap memory by triggering a contextTags array reallocation while a stale pointer is still held. The attacker crafts a deterministic sequence of exactly 34 GLX requests - 17 CreateContext and 17 MakeCurrent calls - to force the realloc, after which GlxFreeContextTag writes zeros into freed memory at five fixed offsets. No CVSS vector or KEV listing is present; the vulnerability was discovered by an anonymous researcher through Trend Micro Zero Day Initiative (ZDI-CAN-30561), indicating active vulnerability research interest though no public exploit has been confirmed.

RemediationAI

The primary remediation is to upgrade to xorg-server-21.1.24 or xwayland-24.1.13, which include the fix commit 2779affbdb4354e894f490e56f962527d6125043 (see https://gitlab.freedesktop.org/xorg/xserver/-/commit/2779affbdb4354e894f490e56f962527d6125043). Distributions shipping 21.1.x packages should confirm whether commit 4781f2a5a8c2c2b000374e2d87982a6701d5a6b3 was backported into their builds; if so, the corresponding fix commit must also be applied. If an immediate upgrade is not possible, restricting X server access to trusted local users only via XAUTHORITY cookie enforcement (disabling TCP listening with -nolisten tcp) limits the attack surface by preventing unauthenticated or remote clients from creating GLX contexts. This workaround reduces exposure but does not eliminate risk from malicious local users who already have a valid X session. The full X.Org advisory is available at https://seclists.org/oss-sec/2026/q3/94.

Affected VersionsENISA

xorg-x11-server 0 <21.1.24

xwayland 0 <24.1.13

Affected Packages

euvd xorg_x11_server fix: 21.1.24

euvd xwayland fix: 24.1.13

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability resides in CommonMakeCurrent() within the GLX (OpenGL Extension to the X Window System) dispatch layer in glx/vndcmds.c. GLX manages per-client OpenGL context bindings tracked in a dynamically allocated cl->contextTags array. GlxLookupContextTag() returns a raw pointer directly into this array. When a 17th context slot is needed, GlxAllocContextTag() calls realloc() on the array; if the allocator moves the buffer to a new address, the previously captured oldTag pointer becomes a dangling reference. The subsequent GlxFreeContextTag(oldTag) then writes zeros at offsets 16, 24, 32, 36, and 40 bytes into the now-freed heap region - a classic CWE-416 (Use After Free) pattern. The fix (commit 2779affbdb4354e894f490e56f962527d6125043) moves GlxFreeContextTag(oldTag) to execute before CommonMakeNewCurrent() can trigger the realloc, ensuring the pointer is released while still valid. A notable complication is that the advisory states the bug is not reproducible on vanilla xorg-server-21.1.16 but IS present on the main and discontinued master branches, and on any 21.1.x distribution that backported upstream commit 4781f2a5a8c2c2b000374e2d87982a6701d5a6b3.

Know when X Server gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (CNA) PRIMARY 9.0 CRITICAL

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

vuln.today AI 8.8 HIGH

Local X display access required (AV:L); PR:L because valid X client authorization is needed; scope change (S:C) as X server compromise affects all connected clients.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE 7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Red Hat 6.5 HIGH

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

High

Attack Requirements

None

Privileges Required

Low

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

High

Vulnerable system: Availability

High

Subsequent system: Confidentiality

High

Subsequent system: Integrity

High

Subsequent system: Availability

High

Lifecycle Timeline

Patch available

Jul 08, 2026 - 09:01 EUVD

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical Use-After-Free in GitLab GLX Dispatch Layer - CVE-2026-56000 Jul 08, 2026

Zero Day Initiative Advisories

ZDI-26-405 X.Org Server GLX Extension Use-After-Free Privilege Escalation Vulnerability Jul 2026

Executive ViewAI

Why It Matters

A critical use-after-free vulnerability in X.Org X Server and Xwayland's GLX dispatch layer enables authenticated X clients to corrupt heap memory through a precisely crafted 34-request sequence, creating risk of privilege escalation or denial of service. This impacts organizations operating X-based graphical infrastructure, particularly Linux environments with multi-user systems or remote display access. No patch is currently available, and immediate access controls are required to limit exposure.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict X11 socket (/tmp/.X11-unix) file permissions to owner only; (2) Disable GLX extension via xorg.conf if not operationally required; (3) Implement network firewall rules blocking TCP 6000+ access unless X11 forwarding is explicitly needed; (4) Require SSH key-based authentication and restrict X11 forwarding scope in multi-user environments; (5) Use containerization to isolate X Server processes with restricted IPC access; (6) Monitor X Server logs for abuse patterns matching the 34-request GLX sequence (17 CreateContext + 17 MakeCurrent calls).

Threat Intelligence Overview

EPSS Score

0.2%

Top 88% exploitable

Prevalence

Medium

standard Linux desktop display server, absent from most headless server deployments

Threat Intel

1 sources

Social Media

Sightings

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment NEWS MSRC Vendor CIRCL

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +45

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Related Vulnerabilities in X.Org X Server and Xwayland Security Flaws

View all 2

CVE-2026-55999 HIGH

7.8

More in X Server

View all

CVE-2018-14665 MEDIUM This Month POC

6.6 Oct 25

A flaw was found in xorg-x11-server before 1.20.3. Rated medium severity (CVSS 6.6), this vulnerability is low attack co

CVE-2019-17624 HIGH This Week POC

7.8 Oct 16

"" In X.Org X Server 1.20.4, there is a stack-based buffer overflow in the function XQueryKeymap. Rated high severity (C

CVE-2023-6816 CRITICAL Act Now

9.8 Jan 18

A heap overflow vulnerability exists in X.Org Server and Xwayland where improper memory allocation for logical button ma

CVE-2017-10971 HIGH This Week

8.8 Jul 06

In the X.Org X server before 2017-06-19, a user authenticated to an X Session could crash or execute code in the context

CVE-2022-46344 HIGH This Week

8.8 Dec 14