CVE-2026-50262: Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: out-of-bounds read/write in glx changedrawableattributes
A wrong size validation check in glXDispChangeDrawableAttributes() can read (or write) a client-controlled number of bytes, exceeding the request buffer. The write path requires byte-swapped clients which is disabled by default. The read can lead to information disclosure; the write can crash the server or enable privilege escalation if the X server runs as root.
Any X client that can connect to the server can trigger this issue.
Components affected: xorg-x11-server, xorg-x11-server-Xwayland Versions affected: xorg-x11-server <= 21.1.22, xorg-x11-server-Xwayland <= 24.1.9
Fixed upstream in xorg-server-21.1.23 and xwayland-24.1.12. Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/6d459e4daf715bea8abdafa8fb130be2f8a1d145
Reported via ZDI-CAN-30165 (Trend Micro Zero Day Initiative). Tracking: PSIRTSUPT-16950.
Other sources
An out-of-bounds read flaw was found in the X.Org X server and Xwayland in glXDispChangeDrawableAttributes(). A wrong size validation check can read a client-controlled number of bytes, exceeding the request buffer, leading to information disclosure. A write path also exists but requires byte-swapped clients which is disabled by default.
— NVD
Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: out-of-bounds read/write in glx changedrawableattributes
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.1.12-1 - Upgrade
Upgrade
xorg-x11-serverto a version that resolves this vulnerability.Fixed in 21.1.23 - Upgrade
Upgrade
xorg-x11-server-Xwaylandto a version that resolves this vulnerability.Fixed in 24.1.12 - Compensating control
Because the write path requires byte-swapped clients, ensure byte-swapped clients are not enabled; this path is disabled by default per the advisory.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50262?
CVE-2026-50262 has a medium severity rating of 5.5.
How do I fix CVE-2026-50262?
To mitigate CVE-2026-50262, update to the latest version of the X.Org X server and Xwayland that addresses this vulnerability.
What are the potential impacts of CVE-2026-50262?
CVE-2026-50262 may lead to information disclosure due to an out-of-bounds read flaw in the X server and Xwayland.
What components are affected by CVE-2026-50262?
CVE-2026-50262 affects the X.Org X server and X.Org Xwayland components.
Is CVE-2026-50262 exploitable remotely?
CVE-2026-50262 can be exploited locally since it involves client-controlled interactions.