CVE-2026-50264: Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: out-of-bounds heap write in dri2 drigetbuffers/drigetbufferswithformat
A client that requests multiple DRI2BufferBackLeft attachments and one DRI2BufferFrontLeft can trigger an out-of-bounds heap write in DRIGetBuffers/DRIGetBuffersWithFormat.
Any local X client that can connect to the server can trigger this issue. This may be used to crash the server, or for privilege escalation if the X server runs as root.
Components affected: xorg-x11-server, xorg-x11-server-Xwayland Versions affected: xorg-x11-server <= 21.1.22, xorg-x11-server-Xwayland <= 24.1.9
Fixed upstream in xorg-server-21.1.23 and xwayland-24.1.12. Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/339c279514326134b0878fc23ce6e9520440ce7f
Identified by Peter Hutterer, Red Hat. Tracking: PSIRTSUPT-16950.
Other sources
An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat. A client that requests multiple DRI2BufferBackLeft attachments and one DRI2BufferFrontLeft can trigger an out-of-bounds heap write. This may be used to crash the server, or for privilege escalation if the X server runs as root.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
xorg-x11-serverto a version that resolves this vulnerability.Fixed in 21.1.23 - Upgrade
Upgrade
xorg-x11-server-Xwaylandto a version that resolves this vulnerability.Fixed in 24.1.12 - Compensating control
Restrict local access to the X server/Xwayland socket so that only trusted local clients can connect, to reduce exposure to clients triggering the DRI2Buffer attachment issue.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50264?
The severity of CVE-2026-50264 is high, rated at 7.8.
What is CVE-2026-50264?
CVE-2026-50264 is an out-of-bounds heap write flaw found in the X.Org X server and Xwayland.
How does CVE-2026-50264 affect users?
CVE-2026-50264 can cause the X server to crash or potentially lead to privilege escalation.
How can I mitigate CVE-2026-50264?
Mitigation for CVE-2026-50264 involves updating to the latest patched version of the X.Org X server or Xwayland.
What software is affected by CVE-2026-50264?
CVE-2026-50264 affects the X.Org X server and X.Org Xwayland components.