Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain local unprivileged shell on target
  2. Delivery
    Connect to local X server or Xwayland display
  3. Exploit
    Send crafted DRI2 GetBuffers request with multiple BackLeft and one FrontLeft attachment
  4. Execution
    Trigger out-of-bounds heap write in DRIGetBuffers
  5. Persist
    Groom heap and hijack control flow in X server process
  6. Impact
    Execute payload as root (setuid Xorg) or crash display server

Vulnerability Assessment

Weakness
CWE
CWE-787
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

The attacker must already have local code execution as an unprivileged user with the ability to open a connection to a running X.Org X server or Xwayland instance - typically meaning an interactive desktop session, a console login, or SSH access permitting X client connections to the local display. The vulnerable path is reached only by issuing DRI2 GetBuffers or GetBuffersWithFormat requests with the specific attachment combination of multiple DRI2BufferBackLeft entries and one DRI2BufferFrontLeft, so the target server must have the DRI2 extension enabled (the default on virtually all Linux desktop installations). Privilege escalation to root specifically requires the Xorg binary to be installed setuid root, which is the historical default on traditional Linux desktops but no longer the case on modern Wayland-first distributions where Xwayland runs as the invoking user; on those systems the realistic outcome is denial of service of the graphical session rather than EoP. No user interaction beyond the attacker's own client is required (UI:N).
Impact

The CVSS 7.8 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects a local-only attack requiring a logged-in user but no further interaction, with full confidentiality, integrity, and availability impact - consistent with root-equivalent compromise on systems where Xorg is setuid root. No EPSS score, KEV listing, or SSVC decision is provided in the source data, and no public exploit is identified at time of analysis, so widespread mass exploitation is unlikely in the near term. The real-world priority is elevated on multi-user Linux hosts, shared workstations, jump boxes, and any system still running the classic setuid Xorg server; on modern Wayland-default desktops where Xwayland runs unprivileged, the realistic impact reduces to a session-level denial of service. Note the affected-product list duplicates Red Hat Enterprise Linux 8 and 9 entries, which appears to be a CPE data artifact rather than two distinct product variants.
Exploit ScenarioDerived

A local user with an active graphical session (or SSH access that lets them launch an X client against a local :0 display) writes a small DRI2 client that issues a GetBuffers request listing multiple DRI2BufferBackLeft attachments plus one DRI2BufferFrontLeft, triggering the heap out-of-bounds write. On a system where Xorg runs setuid root, careful heap grooming turns the corruption into arbitrary code execution as root; on Xwayland or rootless Xorg deployments, the same input reliably crashes the display server and terminates the user session. No public exploit is identified at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 05, 2026

Out-of-bounds heap write in X.Org X server and Xwayland DRI2 buffer handling allows a local authenticated client to corrupt server memory by requesting multiple DRI2BufferBackLeft attachments alongside one DRI2BufferFrontLeft. Successful exploitation crashes the display server or, when the X server runs setuid root (a still-common legacy deployment), enables local privilege escalation to root. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV.

RemediationAI

Upstream fix available (commit 339c279514326134b0878fc23ce6e9520440ce7f on freedesktop.org gitlab); a released patched tag is not independently confirmed from the data provided, so consume the fix via your distribution. On Red Hat Enterprise Linux 6 through 10, install the updated xorg-x11-server and xwayland packages as published in the advisory at https://access.redhat.com/security/cve/CVE-2026-50264 once available for your stream, applying out-of-cycle errata for any RHEL 6/7 systems still under extended support contracts. As a compensating control until packages are deployed, remove the setuid bit from the Xorg binary (chmod u-s /usr/libexec/Xorg or equivalent) to neutralize the privilege-escalation path - this requires switching to a logind/rootless or KMS-based startup and will break legacy startx flows that depend on setuid Xorg. On systems where Wayland is viable, prefer a Wayland session so Xwayland runs unprivileged, reducing impact to a per-session crash; restrict interactive and SSH-with-X-forwarding access on shared multi-user hosts to limit who can reach the vulnerable code path.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The flaw lives in the DRIGetBuffers and DRIGetBuffersWithFormat code paths of the X.Org X server and its Xwayland compatibility layer, which implement the DRI2 protocol used by clients to obtain direct rendering buffer attachments. The server allocates buffer arrays sized for the expected attachment combinations, but does not properly bound the case where a client requests multiple DRI2BufferBackLeft entries together with a DRI2BufferFrontLeft, leading to a heap write past the end of the allocation. This is a classic CWE-787 out-of-bounds write in a long-lived, privileged graphics process that historically runs with elevated privileges on traditional Linux desktops, making memory corruption here particularly dangerous.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SUSE HIGH
Red Hat 7.8 HIGH

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat. A client that requests multiple DRI2BufferBackLeft attachments and one DRI2BufferFrontLeft can trigger an out-of-bounds heap write. This may be used to crash the server, or for privilege escalation if the X server runs as root.

Executive ViewAI

Why It Matters

A vulnerability in X.Org X server and Xwayland could allow employees with local system access to disrupt display operations or gain administrative control on workstations, particularly in organizations maintaining legacy privilege configurations. Without an available vendor patch, immediate interim controls are necessary to prevent unauthorized administrative access and desktop availability disruptions across the workstation fleet.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Disable administrative privilege escalation (setuid) on X server binaries; enforce least-privilege operation; restrict access to advanced graphics buffer operations; monitor for official security patches from X.Org and Xwayland maintainers.

Threat Intelligence Overview

EPSS Score
0.0%
Top 98% exploitable
Social Media
1
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available No
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-4775 HIGH POC
7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-50264 ADVISORY https://vuldb.com/vuln/368916 REF https://access.redhat.com/errata/RHSA-2026:26562 REF https://access.redhat.com/errata/RHSA-2026:26566 REF https://access.redhat.com/errata/RHSA-2026:26590 REF https://access.redhat.com/errata/RHSA-2026:26610 REF https://access.redhat.com/errata/RHSA-2026:26709 REF https://access.redhat.com/errata/RHSA-2026:28923 REF https://access.redhat.com/errata/RHSA-2026:29844 REF https://access.redhat.com/errata/RHSA-2026:36083 REF https://access.redhat.com/errata/RHSA-2026:36085 REF https://access.redhat.com/errata/RHSA-2026:36086 REF https://access.redhat.com/errata/RHSA-2026:36087 REF https://access.redhat.com/errata/RHSA-2026:36632 REF https://access.redhat.com/errata/RHSA-2026:36633 REF https://access.redhat.com/errata/RHSA-2026:36634 REF https://access.redhat.com/errata/RHSA-2026:36768 REF https://access.redhat.com/errata/RHSA-2026:36791 REF https://access.redhat.com/errata/RHSA-2026:36792 REF https://access.redhat.com/errata/RHSA-2026:36798 REF https://access.redhat.com/errata/RHSA-2026:38502 REF https://access.redhat.com/errata/RHSA-2026:38810 REF https://access.redhat.com/errata/RHSA-2026:46377 REF https://access.redhat.com/errata/RHSA-2026:46382 REF https://access.redhat.com/errata/RHSA-2026:46385 REF https://access.redhat.com/errata/RHSA-2026:46392 REF https://access.redhat.com/errata/RHSA-2026:46456 REF https://access.redhat.com/errata/RHSA-2026:46460 REF https://access.redhat.com/errata/RHSA-2026:46473 REF https://access.redhat.com/security/cve/CVE-2026-50264 REF https://bugzilla.redhat.com/show_bug.cgi?id=2485389 REF https://gitlab.freedesktop.org/xorg/xserver/-/commit/339c279514326134b0878fc23ce6e9520440ce7f REF https://lists.x.org/archives/xorg-announce/2026-June/003702.html REF https://redhat.atlassian.net/browse/PSIRTSUPT-16950 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50264.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy