Junglewise Threat Intelligence

CVE-2026-50264: X.Org X server and Xwayland out-of-bounds write in DRI2

CVE-2026-50264 · Severity: high · CVSS 7.8 · Published 2026-06-05

Technologies: X.Org Foundation Xorg-X11-Server. Vendors: X.Org, X.Org Foundation.

Executive brief

A security vulnerability has been identified in the X.Org X server and Xwayland, which are fundamental components used to manage graphical displays and user input on Linux systems. A local user or malicious application could exploit this flaw to crash the system or potentially gain administrative (root) privileges. This could lead to a complete takeover of the affected machine or a disruption of services.

Technical details

An out-of-bounds (OOB) heap write vulnerability exists in the DRIGetBuffers and DRIGetBuffersWithFormat functions within the DRI2 module of the X.Org X server and Xwayland. The flaw is triggered when a client requests multiple DRI2BufferBackLeft attachments alongside a DRI2BufferFrontLeft attachment, leading to an incorrect buffer allocation size that does not account for duplicate attachments. A local attacker with the ability to connect to the X server can exploit this to corrupt heap memory, potentially achieving arbitrary code execution with the privileges of the X server (often root). The issue has been addressed in xorg-server version 21.1.23 and xwayland version 24.1.12 by implementing attachment deduplication using a bit-set.

Affected products

  • X.Org xorg-x11-server <= 21.1.22
  • X.Org xorg-x11-server-Xwayland <= 24.1.9

Timeline

  • 2026-05-15: other: Fix authored upstream
  • 2026-06-01: other: Fix committed upstream
  • 2026-06-02: advisory: X.Org security advisory released
  • 2026-06-05: disclosed: CVE published and Red Hat advisory issued

References