Skip to main content

X.Org X Server EUVDEUVD-2026-42202

| CVE-2026-56000 CRITICAL
Use After Free (CWE-416)
2026-07-08 GHSA-4gcc-rqqq-58jp
Memory Corruption Denial Of Service Use After Free X Server Xwayland Red Hat Suse
9.0
CVSS 4.0 · Vendor
Share

Severity by source

Vendor (CNA) PRIMARY
9.0 CRITICAL
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.8 HIGH

Local X display access required (AV:L); PR:L because valid X client authorization is needed; scope change (S:C) as X server compromise affects all connected clients.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SUSE
7.0 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
6.5 HIGH
qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

2
Patch available
Jul 08, 2026 - 09:01 EUVD
Analysis Generated
Jul 08, 2026 - 02:16 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical Use-After-Free in GitLab GLX Dispatch Layer - CVE-2026-56000 Jul 08, 2026

AnalysisAI

Use-after-free in the GLX dispatch layer of X.Org X Server and Xwayland allows an authenticated X client to corrupt heap memory by triggering a contextTags array reallocation while a stale pointer is still held. The attacker crafts a deterministic sequence of exactly 34 GLX requests - 17 CreateContext and 17 MakeCurrent calls - to force the realloc, after which GlxFreeContextTag writes zeros into freed memory at five fixed offsets. No CVSS vector or KEV listing is present; the vulnerability was discovered by an anonymous researcher through Trend Micro Zero Day Initiative (ZDI-CAN-30561), indicating active vulnerability research interest though no public exploit has been confirmed.

Technical ContextAI

The vulnerability resides in CommonMakeCurrent() within the GLX (OpenGL Extension to the X Window System) dispatch layer in glx/vndcmds.c. GLX manages per-client OpenGL context bindings tracked in a dynamically allocated cl->contextTags array. GlxLookupContextTag() returns a raw pointer directly into this array. When a 17th context slot is needed, GlxAllocContextTag() calls realloc() on the array; if the allocator moves the buffer to a new address, the previously captured oldTag pointer becomes a dangling reference. The subsequent GlxFreeContextTag(oldTag) then writes zeros at offsets 16, 24, 32, 36, and 40 bytes into the now-freed heap region - a classic CWE-416 (Use After Free) pattern. The fix (commit 2779affbdb4354e894f490e56f962527d6125043) moves GlxFreeContextTag(oldTag) to execute before CommonMakeNewCurrent() can trigger the realloc, ensuring the pointer is released while still valid. A notable complication is that the advisory states the bug is not reproducible on vanilla xorg-server-21.1.16 but IS present on the main and discontinued master branches, and on any 21.1.x distribution that backported upstream commit 4781f2a5a8c2c2b000374e2d87982a6701d5a6b3.

RemediationAI

The primary remediation is to upgrade to xorg-server-21.1.24 or xwayland-24.1.13, which include the fix commit 2779affbdb4354e894f490e56f962527d6125043 (see https://gitlab.freedesktop.org/xorg/xserver/-/commit/2779affbdb4354e894f490e56f962527d6125043). Distributions shipping 21.1.x packages should confirm whether commit 4781f2a5a8c2c2b000374e2d87982a6701d5a6b3 was backported into their builds; if so, the corresponding fix commit must also be applied. If an immediate upgrade is not possible, restricting X server access to trusted local users only via XAUTHORITY cookie enforcement (disabling TCP listening with -nolisten tcp) limits the attack surface by preventing unauthenticated or remote clients from creating GLX contexts. This workaround reduces exposure but does not eliminate risk from malicious local users who already have a valid X session. The full X.Org advisory is available at https://seclists.org/oss-sec/2026/q3/94.

More in X Server

View all
CVE-2018-14665 MEDIUM POC
6.6 Oct 25

A flaw was found in xorg-x11-server before 1.20.3. Rated medium severity (CVSS 6.6), this vulnerability is low attack co
CVE-2019-17624 HIGH POC
7.8 Oct 16

"" In X.Org X Server 1.20.4, there is a stack-based buffer overflow in the function XQueryKeymap. Rated high severity (C
CVE-2017-10971 HIGH
8.8 Jul 06

In the X.Org X server before 2017-06-19, a user authenticated to an X Session could crash or execute code in the context
CVE-2022-46344 HIGH
8.8 Dec 14

A vulnerability was found in X.Org. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low atta
CVE-2022-46343 HIGH
8.8 Dec 14

A vulnerability was found in X.Org. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low atta
CVE-2022-46342 HIGH
8.8 Dec 14

A vulnerability was found in X.Org. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low atta
CVE-2022-46341 HIGH
8.8 Dec 14

A vulnerability was found in X.Org. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low atta
CVE-2022-46340 HIGH
8.8 Dec 14

A vulnerability was found in X.Org. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low atta
CVE-2022-3550 HIGH
8.8 Oct 17

A vulnerability classified as critical was found in X.org Server. Rated high severity (CVSS 8.8), this vulnerability is

CVE-2023-5367 HIGH
7.8 Oct 25

A out-of-bounds write flaw was found in the xorg-x11-server. Rated high severity (CVSS 7.8), this vulnerability is low a
CVE-2023-6377 HIGH
7.8 Dec 13

A flaw was found in xorg-server. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Out-o
CVE-2026-55999 HIGH
7.8 Jul 08

Local privilege escalation via heap buffer overflow in the X.Org Server (versions before 21.1.24) and Xwayland (before 2

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Memory Corruption

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
Container suse/kiosk/xorg:21.1-82.11 Affected
SUSE Liberty Linux 10 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed

Share

EUVD-2026-42202 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy