# CVE-2026-50263: X.Org X server and Xwayland use-after-free in CreateSaverWindow

Source: https://junglewise.ai/threats/cve-2026-50263-x-org-x-server-and-xwayland-use-after-free-in-createsaverwindow  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-05. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2026-50263 · Severity: medium · CVSS 5.5 · Published 2026-06-05

A security vulnerability has been identified in the X.Org X server and Xwayland, which are fundamental components used to manage graphical displays and windows on Linux systems. An attacker with local access to a system could exploit this flaw to read sensitive information from the computer's memory that they should not be able to access. This could lead to the exposure of private data or help an attacker bypass other security protections. The issue has been resolved in the latest software updates.

Technologies: [X.Org Xorg-Server](https://junglewise.ai/threats/technologies/xorg-server). Vendors: [X.Org](https://junglewise.ai/threats/vendors/x-org).

## Quick answers

**Is CVE-2026-50263 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50263 being exploited in the wild.

**How severe is CVE-2026-50263?** Medium severity, with a CVSS score of 5.5, published 5 June 2026.

**Which products and versions are affected?** X.Org Xorg-Server < 21.1.23.

**Is there a fix for CVE-2026-50263?** A patch was published on 2026-04-20: Upstream commit authored by Peter Hutterer Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50263 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-50263?** Check whether you run X.Org Xorg-Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free (UAF) vulnerability exists in the 'CreateSaverWindow()' function within the X.Org X server and Xwayland. The flaw occurs when the 'CheckScreenPrivate()' function frees the screen private structure if it is deemed unused, but the caller continues to dereference the pointer immediately afterward. An attacker can trigger this by specifically sequence-changing window attributes and forcing the screen saver (e.g., SetAttributes, ForceScreenSaver, UnsetAttributes, and then ForceScreenSaver again). This results in a use-after-free read, which can be leveraged for information disclosure. The vulnerability is tracked as ZDI-CAN-30168 and is fixed in xorg-server 21.1.23 and xwayland 24.1.12.

## Affected products

- X.Org xorg-server < 21.1.23
- X.Org xwayland < 24.1.12

## Timeline

- 2026-04-20: patched: Upstream commit authored by Peter Hutterer
- 2026-06-02: advisory: X.Org security advisory released
- 2026-06-05: disclosed: CVE published and Red Hat advisory issued

## References

- [https://access.redhat.com/security/cve/CVE-2026-50263](https://access.redhat.com/security/cve/CVE-2026-50263)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2485388](https://bugzilla.redhat.com/show_bug.cgi?id=2485388)
- [https://gitlab.freedesktop.org/xorg/xserver/-/commit/ecc634f1b2f7aa473d3a267eada98c4918bf9e05](https://gitlab.freedesktop.org/xorg/xserver/-/commit/ecc634f1b2f7aa473d3a267eada98c4918bf9e05)
- [https://lists.x.org/archives/xorg-announce/2026-June/003702.html](https://lists.x.org/archives/xorg-announce/2026-June/003702.html)
- [https://redhat.atlassian.net/browse/PSIRTSUPT-16950](https://redhat.atlassian.net/browse/PSIRTSUPT-16950)

## Related threats

- [X.Org xorg-server and xwayland heap use-after-free in GLX CommonMakeCurrent](https://junglewise.ai/threats/cve-2026-56000-x-org-xorg-server-and-xwayland-heap-use-after-free-in-glx)
- [X.Org xorg-server and xwayland heap buffer overflow in glamor font atlas](https://junglewise.ai/threats/cve-2026-55999-x-org-xorg-server-and-xwayland-heap-buffer-overflow-in-glamor)