Junglewise Threat Intelligence

CVE-2026-50262: X.Org X server and Xwayland out-of-bounds read in GLX ChangeDrawableAttributes

CVE-2026-50262 · Severity: medium · CVSS 5.5 · Published 2026-06-05

Vendors: X.Org.

Executive brief

A security vulnerability exists in the X.Org X server and Xwayland, which are fundamental components used to manage graphical displays on Linux and Unix-like systems. An attacker with local access to a system could exploit this flaw to read sensitive information from the computer's memory that they should not be able to access. In specific, non-default configurations, this could also lead to a system crash or allow an attacker to gain higher-level administrative privileges.

Technical details

An out-of-bounds read/write flaw was identified in __glXDisp_ChangeDrawableAttributes() and its byte-swapped counterpart within the X.Org X server and Xwayland. The root cause is a reversed length validation check where the code tests if the computed request size is less than the actual request length, rather than greater than, allowing undersized requests to pass. A local attacker can provide a crafted 'numAttribs' value to trigger an out-of-bounds read, leading to information disclosure. While an out-of-bounds write is also possible (potentially leading to privilege escalation if the server runs as root), it requires byte-swapped clients which are disabled by default. The issue is fixed in xorg-server 21.1.23 and xwayland 24.1.12.

Affected products

  • X.Org X server <= 21.1.22
  • X.Org Xwayland <= 24.1.9

Timeline

  • 2026-04-20: patched: Fix committed to upstream repository.
  • 2026-06-02: advisory: X.Org security advisory released.
  • 2026-06-05: disclosed: CVE published and NVD entry created.

References