Is CVE-2026-50264 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-50264 being exploited in the wild.

How severe is CVE-2026-50264?

High severity, with a CVSS score of 7.8, published 5 June 2026.

Which products and versions are affected?

X.Org Foundation Xorg-X11-Server <= 21.1.22.

Is there a fix for CVE-2026-50264?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-50264 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-50264?

Check whether you run X.Org Foundation Xorg-X11-Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50264: X.Org X server and Xwayland out-of-bounds write in DRI2

Q: Is there a fix for CVE-2026-50264?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-50264 attacked?

It is attacked with local access, in an operating system.

Q: Am I affected by CVE-2026-50264?

Check whether you run X.Org Foundation Xorg-X11-Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50264 · Severity: high · CVSS 7.8 · Published 2026-06-05

A security vulnerability has been identified in the X.Org X server and Xwayland, which are fundamental components used to manage graphical displays and user input on Linux systems. A local user or malicious application could exploit this flaw to crash the system or potentially gain administrative (root) privileges. This could lead to a complete takeover of the affected machine or a disruption of services.

Technologies: X.Org Foundation Xorg-X11-Server. Vendors: X.Org Foundation.

Quick answers

Is CVE-2026-50264 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-50264 being exploited in the wild.
How severe is CVE-2026-50264?: High severity, with a CVSS score of 7.8, published 5 June 2026.
Which products and versions are affected?: X.Org Foundation Xorg-X11-Server <= 21.1.22.
Is there a fix for CVE-2026-50264?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-50264 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-50264?: Check whether you run X.Org Foundation Xorg-X11-Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds (OOB) heap write vulnerability exists in the DRIGetBuffers and DRIGetBuffersWithFormat functions within the DRI2 module of the X.Org X server and Xwayland. The flaw is triggered when a client requests multiple DRI2BufferBackLeft attachments alongside a DRI2BufferFrontLeft attachment, leading to an incorrect buffer allocation size that does not account for duplicate attachments. A local attacker with the ability to connect to the X server can exploit this to corrupt heap memory, potentially achieving arbitrary code execution with the privileges of the X server (often root). The issue has been addressed in xorg-server version 21.1.23 and xwayland version 24.1.12 by implementing attachment deduplication using a bit-set.

Affected products

X.Org xorg-x11-server <= 21.1.22
X.Org xorg-x11-server-Xwayland <= 24.1.9

Timeline

2026-05-15: other: Fix authored upstream
2026-06-01: other: Fix committed upstream
2026-06-02: advisory: X.Org security advisory released
2026-06-05: disclosed: CVE published and Red Hat advisory issued

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.