CVE-2026-50263
Modified Modified - Updated After Analysis
Use-After-Free in X.Org X Server and Xwayland

Publication date: 2026-06-05

Last updated on: 2026-06-25

Assigner: Red Hat, Inc.

Description
A use-after-free flaw was found in the X.Org X server and Xwayland in CreateSaverWindow(). A client can trigger a use-after-free read after changing window attributes and forcing the screen saver, leading to information disclosure.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-05
Last Modified
2026-06-25
Generated
2026-06-25
AI Q&A
2026-06-05
EPSS Evaluated
2026-06-24
NVD
CVE-2026-50263
EUVD
EUVD-2026-34820
Affected Vendors & Products
Showing 6 associated CPEs
Vendor Product Version / Range
redhat enterprise_linux 7.0
redhat enterprise_linux 8.0
redhat enterprise_linux 9.0
redhat enterprise_linux 10.0
x.org x_server to 21.1.23 (exc)
x.org xwayland to 24.1.12 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a use-after-free flaw found in the X.Org X server and Xwayland, specifically in the CreateSaverWindow() function.

A client connected to the X server can trigger this flaw by changing window attributes and forcing the screen saver, which causes the program to read memory that has already been freed.

This results in information disclosure, meaning sensitive data could be exposed unintentionally.

Compliance Impact

This vulnerability leads to information disclosure due to a use-after-free flaw in the X.Org X server and Xwayland. Information disclosure vulnerabilities can potentially impact compliance with data protection regulations such as GDPR and HIPAA, which require the protection of sensitive and personal data from unauthorized access.

Since the vulnerability allows a client connected to the X server to read freed memory, it could expose sensitive information, thereby increasing the risk of non-compliance with standards that mandate confidentiality and data protection.

Impact Analysis

The vulnerability allows an attacker with local access and low privileges to cause the X server to read freed memory, potentially exposing sensitive information.

Since the flaw leads to information disclosure, it could compromise confidentiality of data handled by the X server.

However, it does not impact integrity or availability, as it does not allow modification or denial of service.

Detection Guidance

This vulnerability affects specific versions of the xorg-x11-server and xorg-x11-server-Xwayland components. Detection involves identifying if these vulnerable versions are installed on your system.

  • Check the installed version of xorg-x11-server with a command like: rpm -q xorg-x11-server
  • Check the installed version of xorg-x11-server-Xwayland with a command like: rpm -q xorg-x11-server-Xwayland

If the versions are less than or equal to 21.1.22 for xorg-x11-server or less than or equal to 24.1.9 for xorg-x11-server-Xwayland, the system is vulnerable.

Mitigation Strategies

To mitigate this vulnerability, update the affected components to the fixed versions or later.

  • Upgrade xorg-x11-server to version 21.1.23 or later.
  • Upgrade xorg-x11-server-Xwayland to version 24.1.12 or later.

These updates fix the use-after-free flaw in the CreateSaverWindow() function that leads to information disclosure.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50263. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart