Out-of-Bounds Read Vulnerability in X.Org X Server and Xwayland
CVE-2026-50262
5.5MEDIUM
Key Information:
- Vendor
Red Hat
- Status
- Vendor
- CVE Published:
- 5 June 2026
What is CVE-2026-50262?
An out-of-bounds read flaw exists in the X.Org X server and Xwayland functions, particularly in __glXDisp_ChangeDrawableAttributes(). This vulnerability results from improper size validation checks that allow a client-controlled number of bytes to be read, potentially exceeding the request buffer limit. This condition can lead to inadvertent information disclosure. Although a write path has been identified, it is typically disabled by default and requires byte-swapped clients to be exploited.
Affected Version(s)
Red Hat Enterprise Linux 10 0:24.1.9-4.el10_2.2
Red Hat Enterprise Linux 10.0 Extended Update Support 0:24.1.5-6.el10_0.1
Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:1.20.4-35.el7_9
References
CVSS V3.1
Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Upstream acknowledges Anonymous (Trend Micro Zero Day Initiative) as the original reporter.