CVE-2026-50262 json
Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: out-of-bounds read/write in glx changedrawableattributes
published 2026-06-05 5 mo ago modified 2026-11-05 3 d ago also EUVD-2026-34819
- cvss
- 5.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.1%
- EPSS 0.1% chance of exploitation in 30 days, percentile 2%
- public exploits
- 0
- none known
Summary
An out-of-bounds read flaw was found in the X.Org X server and Xwayland in __glXDisp_ChangeDrawableAttributes(). A wrong size validation check can read a client-controlled number of bytes, exceeding the request buffer, leading to information disclosure. A write path also exists but requires byte-swapped clients which is disabled by default.
Patch / fix
- Red Hat Red Hat Enterprise Linux 10 0:24.1.9-4.el10_2.2
- Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:24.1.5-6.el10_0.1
- Red Hat Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION 0:1.1.0-25.el6_10.18
- Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:1.8.0-36.el7_9.5, 0:1.20.4-35.el7_9
- Red Hat Red Hat Enterprise Linux 8 0:1.15.0-10.el8_10, 0:1.20.11-28.el8_10.2, 0:21.1.3-20.el8_10.2
- Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 0:1.11.0-8.el8_4.16, 0:1.20.10-5.el8_4
- Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 0:1.11.0-8.el8_4.16, 0:1.20.10-5.el8_4
- Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 0:1.12.0-6.el8_6.18, 0:1.20.11-8.el8_6, 0:21.1.3-2.el8_6.7
- Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 0:1.12.0-6.el8_6.18, 0:1.20.11-8.el8_6, 0:21.1.3-2.el8_6.7
- Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 0:1.12.0-15.el8_8.18, 0:1.20.11-19.el8_8, 0:21.1.3-13.el8_8.1
- Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 0:1.12.0-15.el8_8.18, 0:1.20.11-19.el8_8, 0:21.1.3-13.el8_8.1
- Red Hat Red Hat Enterprise Linux 9 0:1.15.0-7.el9_8.2, 0:1.20.11-34.el9_8.2, 0:24.1.9-4.el9_8.2
- Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:1.12.0-14.el9_2.15, 0:1.20.11-21.el9_2, 0:21.1.3-10.el9_2.1
- Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 0:1.13.1-8.el9_4.10, 0:1.20.11-29.el9_4, 0:22.1.9-8.el9_4.1
- Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:1.14.1-11.el9_6, 0:1.20.11-34.el9_6, 0:23.2.7-6.el9_6.1
- xwayland Debian 14 2:24.1.12-1
- xorg-server Debian 12 2:21.1.7-3+deb12u13
- xorg-server Debian 13 2:21.1.16-1.3+deb13u3
- xorg-server Debian 14 2:21.1.23-1
debian advisories DEBIAN-CVE-2026-50262
- tigervnc RHEL 9 1.15.0-7.el9_8.2
- tigervnc-icons RHEL 9 1.15.0-7.el9_8.2
- tigervnc-server RHEL 9 1.15.0-7.el9_8.2
- tigervnc-license RHEL 9 1.15.0-7.el9_8.2
- tigervnc-selinux RHEL 9 1.15.0-7.el9_8.2
- tigervnc-server-module RHEL 9 1.15.0-7.el9_8.2
- tigervnc-server-minimal RHEL 9 1.15.0-7.el9_8.2
- tigervnc RHEL 8 1.15.0-10.el8_10
red hat advisories RHSA-2026:49519RHSA-2026:46473RHSA-2026:46456RHSA-2026:46460RHSA-2026:46392RHSA-2026:46385
- tigervnc AlmaLinux 9 1.15.0-7.el9_8.2
- tigervnc-icons AlmaLinux 9 1.15.0-7.el9_8.2
- tigervnc-server AlmaLinux 9 1.15.0-7.el9_8.2
- tigervnc-license AlmaLinux 9 1.15.0-7.el9_8.2
- tigervnc-selinux AlmaLinux 9 1.15.0-7.el9_8.2
- tigervnc-server-module AlmaLinux 9 1.15.0-7.el9_8.2
- tigervnc-server-minimal AlmaLinux 9 1.15.0-7.el9_8.2
- tigervnc AlmaLinux 8 1.15.0-10.el8_10
almalinux advisories ALSA-2026:29844ALSA-2026:28923ALSA-2026:26562ALSA-2026:26566ALSA-2026:26590ALSA-2026:26610
- tigervnc Rocky Linux 9 1.15.0-7.el9_8.2
- tigervnc Rocky Linux 8 1.15.0-10.el8_10
- xorg-x11-server-Xwayland Rocky Linux 10 24.1.9-4.el10_2.2
- xorg-x11-server-Xwayland Rocky Linux 9 24.1.9-4.el9_8.2
- xorg-x11-server Rocky Linux 9 1.20.11-34.el9_8.2
- xorg-x11-server-Xwayland Rocky Linux 8 21.1.3-20.el8_10.2
- xorg-x11-server Rocky Linux 8 1.20.11-28.el8_10.2
rocky linux advisories RLSA-2026:29844RLSA-2026:28923RLSA-2026:26566RLSA-2026:26590RLSA-2026:26610RLSA-2026:26562
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-50262 updated cvss 5.5
xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds read/write in GLX ChangeDrawableAttributes
-
Red Hat Enterprise Linux 6 xorg-x11-server, xorg-x11-server-Xdmx, xorg-x11-server-Xorg, xorg-x11-server-Xvfb, xorg-x11-server-Xnest, xorg-x11-server-common, +2 moreaffected: workaround, no fix planned “Out of support scope”
-
Red Hat CodeReady Linux Builder EUS (v.9.6) xorg-x11-server-source 1.20.11-34.el9_6, xorg-x11-server-Xwayland 23.2.7-6.el9_6.1fixed: vendor fix RHSA-2026:36085
-
Red Hat Enterprise Linux AppStream (v. 8) tigervnc 1.15.0-10.el8_10, tigervnc-icons 1.15.0-10.el8_10, tigervnc-server 1.15.0-10.el8_10, tigervnc-license 1.15.0-10.el8_10, tigervnc-selinux 1.15.0-10.el8_10, xorg-x11-server 1.20.11-28.el8_10.2, +9 morefixed: vendor fix RHSA-2026:28923
-
Red Hat Enterprise Linux AppStream (v. 9) tigervnc 1.15.0-7.el9_8.2, tigervnc-icons 1.15.0-7.el9_8.2, tigervnc-server 1.15.0-7.el9_8.2, tigervnc-license 1.15.0-7.el9_8.2, tigervnc-selinux 1.15.0-7.el9_8.2, xorg-x11-server 1.20.11-34.el9_8.2, +9 morefixed: vendor fix RHSA-2026:29844
-
Red Hat Enterprise Linux AppStream (v. 10) xorg-x11-server-Xwayland 24.1.9-4.el10_2.2fixed: vendor fix RHSA-2026:26566
-
Red Hat Enterprise Linux AppStream AUS (v.8.4) tigervnc 1.11.0-8.el8_4.16, xorg-x11-server 1.20.10-5.el8_4, tigervnc-icons 1.11.0-8.el8_4.16, tigervnc-server 1.11.0-8.el8_4.16, tigervnc-license 1.11.0-8.el8_4.16, tigervnc-selinux 1.11.0-8.el8_4.16, +9 morefixed: vendor fix RHSA-2026:46382
-
Red Hat Enterprise Linux AppStream AUS (v.8.6) tigervnc 1.12.0-6.el8_6.18, xorg-x11-server 1.20.11-8.el8_6, tigervnc-icons 1.12.0-6.el8_6.18, tigervnc-server 1.12.0-6.el8_6.18, tigervnc-license 1.12.0-6.el8_6.18, tigervnc-selinux 1.12.0-6.el8_6.18, +9 morefixed: vendor fix RHSA-2026:46460
-
Red Hat Enterprise Linux AppStream E4S (v.8.8) tigervnc 1.12.0-15.el8_8.18, xorg-x11-server 1.20.11-19.el8_8, tigervnc-icons 1.12.0-15.el8_8.18, tigervnc-server 1.12.0-15.el8_8.18, tigervnc-license 1.12.0-15.el8_8.18, tigervnc-selinux 1.12.0-15.el8_8.18, +9 morefixed: vendor fix RHSA-2026:46385
show 15 moreshow fewer
-
Red Hat Enterprise Linux AppStream E4S (v.9.2) tigervnc 1.12.0-14.el9_2.15, xorg-x11-server 1.20.11-21.el9_2, tigervnc-icons 1.12.0-14.el9_2.15, tigervnc-server 1.12.0-14.el9_2.15, tigervnc-license 1.12.0-14.el9_2.15, tigervnc-selinux 1.12.0-14.el9_2.15, +9 morefixed: vendor fix RHSA-2026:46377
-
Red Hat Enterprise Linux AppStream E4S (v.9.4) tigervnc 1.13.1-8.el9_4.10, tigervnc-icons 1.13.1-8.el9_4.10, xorg-x11-server 1.20.11-29.el9_4, tigervnc-server 1.13.1-8.el9_4.10, tigervnc-license 1.13.1-8.el9_4.10, tigervnc-selinux 1.13.1-8.el9_4.10, +9 morefixed: vendor fix RHSA-2026:46456
-
Red Hat Enterprise Linux AppStream EUS (v. 10.0) xorg-x11-server-Xwayland 24.1.5-6.el10_0.1fixed: vendor fix RHSA-2026:36798
-
Red Hat Enterprise Linux AppStream EUS (v.9.6) tigervnc 1.14.1-11.el9_6, tigervnc-icons 1.14.1-11.el9_6, tigervnc-server 1.14.1-11.el9_6, tigervnc-license 1.14.1-11.el9_6, tigervnc-selinux 1.14.1-11.el9_6, xorg-x11-server 1.20.11-34.el9_6, +9 morefixed: vendor fix RHSA-2026:46392
-
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) tigervnc 1.11.0-8.el8_4.16, xorg-x11-server 1.20.10-5.el8_4, tigervnc-icons 1.11.0-8.el8_4.16, tigervnc-server 1.11.0-8.el8_4.16, tigervnc-license 1.11.0-8.el8_4.16, tigervnc-selinux 1.11.0-8.el8_4.16, +9 morefixed: vendor fix RHSA-2026:46382
-
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) tigervnc 1.12.0-6.el8_6.18, xorg-x11-server 1.20.11-8.el8_6, tigervnc-icons 1.12.0-6.el8_6.18, tigervnc-server 1.12.0-6.el8_6.18, tigervnc-license 1.12.0-6.el8_6.18, tigervnc-selinux 1.12.0-6.el8_6.18, +9 morefixed: vendor fix RHSA-2026:46460
-
Red Hat Enterprise Linux AppStream TUS (v.8.8) tigervnc 1.12.0-15.el8_8.18, xorg-x11-server 1.20.11-19.el8_8, tigervnc-icons 1.12.0-15.el8_8.18, tigervnc-server 1.12.0-15.el8_8.18, tigervnc-license 1.12.0-15.el8_8.18, tigervnc-selinux 1.12.0-15.el8_8.18, +9 morefixed: vendor fix RHSA-2026:46385
-
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) xorg-x11-server-source 1.20.11-34.el9_8.2, xorg-x11-server-Xwayland 24.1.9-4.el9_8.2fixed: vendor fix RHSA-2026:26610
-
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) xorg-x11-server-Xwayland-devel 24.1.9-4.el10_2.2, xorg-x11-server-Xwayland-debuginfo 24.1.9-4.el10_2.2, xorg-x11-server-Xwayland-debugsource 24.1.9-4.el10_2.2fixed: vendor fix RHSA-2026:26566
-
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) xorg-x11-server-Xwayland-devel 24.1.5-6.el10_0.1, xorg-x11-server-Xwayland-debuginfo 24.1.5-6.el10_0.1, xorg-x11-server-Xwayland-debugsource 24.1.5-6.el10_0.1fixed: vendor fix RHSA-2026:36798
-
Red Hat Enterprise Linux CRB (v. 8) xorg-x11-server-source 1.20.11-28.el8_10.2fixed: vendor fix RHSA-2026:26709
-
Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION) tigervnc 1.1.0-25.el6_10.18, tigervnc-server 1.1.0-25.el6_10.18fixed: vendor fix RHSA-2026:49519
-
Red Hat Enterprise Linux Server (v. 7 ELS) tigervnc 1.8.0-36.el7_9.5, tigervnc-icons 1.8.0-36.el7_9.5, xorg-x11-server 1.20.4-35.el7_9, tigervnc-server 1.8.0-36.el7_9.5, tigervnc-license 1.8.0-36.el7_9.5, xorg-x11-server-Xorg 1.20.4-35.el7_9, +3 morefixed: vendor fix RHSA-2026:46473
-
Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION) tigervnc-server-applet 1.1.0-25.el6_10.18, tigervnc-server-module 1.1.0-25.el6_10.18fixed: vendor fix RHSA-2026:49519
-
Red Hat Enterprise Linux Server Optional (v. 7 ELS) xorg-x11-server-Xdmx 1.20.4-35.el7_9, xorg-x11-server-Xvfb 1.20.4-35.el7_9, xorg-x11-server-Xnest 1.20.4-35.el7_9, xorg-x11-server-source 1.20.4-35.el7_9, tigervnc-server-applet 1.8.0-36.el7_9.5, tigervnc-server-module 1.8.0-36.el7_9.5, +1 morefixed: vendor fix RHSA-2026:46473
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 5 mo ago
Exploit prediction
0.13% chance of exploitation in the next 30 days, higher than 2% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected products
- Red Hat Red Hat Enterprise Linux 10
- Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
- Red Hat Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION
- Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
- Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
- Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
- Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
- Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
- Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
- Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
- Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
- Red Hat Red Hat Enterprise Linux 6
Classification
- Weakness
-
- CWE-125 Out-of-bounds Read
References
-
gitlab.freedesktop.org
/xorg/xserver/-/commit/6d459e4daf715bea8abdafa8fb130be2f8a1d145
patch
-
access.redhat.com
/errata/RHSA-2026:26562
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:26566
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:26590
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:26610
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:26709
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:28923
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:29844
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:36083
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:36085
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:36086
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:36087
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:36632
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:36633
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:36634
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:36768
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:36791
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:36792
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:36798
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:38502
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:38810
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:46377
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:46382
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:46385
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:46392
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:46456
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:46460
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:46473
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:49519
vendor-advisory
-
access.redhat.com
/security/cve/CVE-2026-50262
vdb-entry, vendor-advisory
-
bugzilla.redhat.com
/show_bug.cgi?id=2485387
issue-tracking, vendor-advisory
-
lists.x.org
/archives/xorg-announce/2026-June/003702.html
mailing-list, vendor-advisory
-
redhat.atlassian.net
/browse/PSIRTSUPT-16950
permissions-required
Sources
- CVE List CVE-2026-50262
- NVD CVE-2026-50262
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.