CVE-2026-50263

Published: Jun 5, 2026Modified: Jun 11, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: secalert@redhat.com (Secondary)

Description

A use-after-free flaw was found in the X.Org X server and Xwayland in CreateSaverWindow(). A client can trigger a use-after-free read after changing window attributes and forcing the screen saver, leading to information disclosure.

Affected (6)

Products: Redhat: Enterprise Linux · X.org: X Server, Xwayland

1 product

Enterprise Linux

2 products

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 10.0
Redhat Enterprise Linux	Version 7.0
Redhat Enterprise Linux	Version 8.0
Redhat Enterprise Linux	Version 9.0
X.org X Server	Before 21.1.23
X.org Xwayland	Before 24.1.12

Related CWEs

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

References (5)

https://access.redhat.com/security/cve/CVE-2026-50263

Source: secalert@redhat.com

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2485388

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

https://gitlab.freedesktop.org/xorg/xserver/-/commit/ecc634f1b2f7aa473d3a267eada98c4918bf9e05

Source: secalert@redhat.com

Patch

https://lists.x.org/archives/xorg-announce/2026-June/003702.html

Source: secalert@redhat.com

Mailing ListVendor Advisory

https://redhat.atlassian.net/browse/PSIRTSUPT-16950

Source: secalert@redhat.com

Permissions Required

Timeline

No history available yet.