Junglewise Threat Intelligence

CVE-2026-50263: X.Org X server and Xwayland use-after-free in CreateSaverWindow

CVE-2026-50263 · Severity: medium · CVSS 5.5 · Published 2026-06-05

Technologies: X.Org Xorg-Server. Vendors: X.Org.

Executive brief

A security vulnerability has been identified in the X.Org X server and Xwayland, which are fundamental components used to manage graphical displays and windows on Linux systems. An attacker with local access to a system could exploit this flaw to read sensitive information from the computer's memory that they should not be able to access. This could lead to the exposure of private data or help an attacker bypass other security protections. The issue has been resolved in the latest software updates.

Technical details

A use-after-free (UAF) vulnerability exists in the 'CreateSaverWindow()' function within the X.Org X server and Xwayland. The flaw occurs when the 'CheckScreenPrivate()' function frees the screen private structure if it is deemed unused, but the caller continues to dereference the pointer immediately afterward. An attacker can trigger this by specifically sequence-changing window attributes and forcing the screen saver (e.g., SetAttributes, ForceScreenSaver, UnsetAttributes, and then ForceScreenSaver again). This results in a use-after-free read, which can be leveraged for information disclosure. The vulnerability is tracked as ZDI-CAN-30168 and is fixed in xorg-server 21.1.23 and xwayland 24.1.12.

Affected products

  • X.Org xorg-server < 21.1.23
  • X.Org xwayland < 24.1.12

Timeline

  • 2026-04-20: patched: Upstream commit authored by Peter Hutterer
  • 2026-06-02: advisory: X.Org security advisory released
  • 2026-06-05: disclosed: CVE published and Red Hat advisory issued

References

Related threats