Is CVE-2026-50263 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-50263 being exploited in the wild.

How severe is CVE-2026-50263?

Medium severity, with a CVSS score of 5.5, published 5 June 2026.

Is there a fix for CVE-2026-50263?

A patch was published on 2026-04-20: Upstream commit authored by Peter Hutterer Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-50263 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-50263?

Check whether you run X.Org Xorg-Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50263: X.Org X server and Xwayland use-after-free in CreateSaverWindow

CVE-2026-50263 · Severity: medium · CVSS 5.5 · Published 2026-06-05

A security vulnerability has been identified in the X.Org X server and Xwayland, which are fundamental components used to manage graphical displays and windows on Linux systems. An attacker with local access to a system could exploit this flaw to read sensitive information from the computer's memory that they should not be able to access. This could lead to the exposure of private data or help an attacker bypass other security protections. The issue has been resolved in the latest software updates.

Technologies: X.Org Xorg-Server. Vendors: X.Org.

Quick answers

Is CVE-2026-50263 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-50263 being exploited in the wild.
How severe is CVE-2026-50263?: Medium severity, with a CVSS score of 5.5, published 5 June 2026.
Which products and versions are affected?: X.Org Xorg-Server < 21.1.23.
Is there a fix for CVE-2026-50263?: A patch was published on 2026-04-20: Upstream commit authored by Peter Hutterer Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50263 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-50263?: Check whether you run X.Org Xorg-Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A use-after-free (UAF) vulnerability exists in the 'CreateSaverWindow()' function within the X.Org X server and Xwayland. The flaw occurs when the 'CheckScreenPrivate()' function frees the screen private structure if it is deemed unused, but the caller continues to dereference the pointer immediately afterward. An attacker can trigger this by specifically sequence-changing window attributes and forcing the screen saver (e.g., SetAttributes, ForceScreenSaver, UnsetAttributes, and then ForceScreenSaver again). This results in a use-after-free read, which can be leveraged for information disclosure. The vulnerability is tracked as ZDI-CAN-30168 and is fixed in xorg-server 21.1.23 and xwayland 24.1.12.

Affected products

X.Org xorg-server < 21.1.23
X.Org xwayland < 24.1.12

Timeline

2026-04-20: patched: Upstream commit authored by Peter Hutterer
2026-06-02: advisory: X.Org security advisory released
2026-06-05: disclosed: CVE published and Red Hat advisory issued

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.