Use-After-Free Vulnerability in X.Org X Server and Xwayland
CVE-2026-50263

5.5MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 10.0 Extended Update Support
Red Hat Enterprise Linux 7 Extended Lifecycle Support
Red Hat Enterprise Linux 8
Vendor
CVE Published:
5 June 2026

What is CVE-2026-50263?

A use-after-free flaw exists in the X.Org X server and Xwayland within the CreateSaverWindow() function. This vulnerability can be exploited by clients to trigger a use-after-free read when altering window attributes and activating the screen saver. This can potentially lead to unauthorized information disclosure, impacting system integrity and confidentiality. Immediate attention to patching is advised to mitigate potential exploitation.

Affected Version(s)

Red Hat Enterprise Linux 10 0:24.1.9-4.el10_2.2

Red Hat Enterprise Linux 10.0 Extended Update Support 0:24.1.5-6.el10_0.1

Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:1.20.4-35.el7_9

References

https://access.redhat.com/errata/RHSA-2026:26562
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26566
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26590
vendor-advisoryx_refsource_REDHAT

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Upstream acknowledges Anonymous (Trend Micro Zero Day Initiative) as the original reporter.
.