CVE-2026-50263Medium· 5.5▾ SunlitA use-after-free flaw was found in the X.Org X server and Xwayland in CreateSaverWindow(). A client can trigger a use-after-free read after changing window attributes and forcing the screen saver, leading to information disclosure.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.1%
A use-after-free flaw was found in the X.Org X server and Xwayland in CreateSaverWindow(). A client can trigger a use-after-free read after changing window attributes and forcing the screen saver, leading to information disclosure.
x_server < 21.1.23xwayland < 24.1.12enterprise_linux = 7.0enterprise_linux = 8.0enterprise_linux = 9.0enterprise_linux = 10.0Upgrade past the affected range:
x_server 21.1.23xwayland 24.1.12Connected by shared product, vendor, weakness, or advisory.
CVE-2026-50261High· 7.8A use-after-free flaw was found in the X.Org X server and Xwayland in SyncChangeCounter()
CVE-2026-50260High· 7.8A use-after-free flaw was found in the X.Org X server and Xwayland in FreeCounter()
CVE-2026-50257High· 7.8A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence()
CVE-2026-50264High· 7.8An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat
CVE-2026-50262Medium· 5.5An out-of-bounds read flaw was found in the X.Org X server and Xwayland in __glXDisp_ChangeDrawableAttributes()
CVE-2026-50259High· 7.8A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland