5.5Medium

CVE-2026-50263Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free information disclosure in createsaverwindow()

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 6 Extended Lifecycle Suppo… Published: 2026-06-05 13:36 (5 months ago)

Description

A use-after-free flaw was found in the X.Org X server and Xwayland in CreateSaverWindow(). A client can trigger a use-after-free read after changing window attributes and forcing the screen saver, leading to information disclosure.

Weakness (CWE): CWE-416

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
enterprise linux	8	—
enterprise linux	9	—
redhat	enterprise linux	7.0
Red Hat	Red Hat Enterprise Linux 10	all versions
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	all versions
Red Hat	Red Hat Enterprise Linux 6	—
Red Hat	Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION	all versions
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	all versions
Red Hat	Red Hat Enterprise Linux 8	all versions
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	all versions
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	all versions
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	all versions
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	all versions
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	all versions
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	all versions
Red Hat	Red Hat Enterprise Linux 9	all versions
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	all versions
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	all versions
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	all versions
rhel aus	8.4	—
rhel aus	8.6	—
rhel e4s	8.8	—
rhel e4s	9.2	—
rhel e4s	9.4	—
rhel eus	9.6	—
rhel eus long life	8.4	—
rhel eus long life	8.6	—
rhel tus	8.8	—
x.org	x server	< 21.1.23
x.org	xwayland	< 24.1.12

References and patches

RHSA-2026:26562 vendor-advisory
RHSA-2026:26566 vendor-advisory
RHSA-2026:26590 vendor-advisory
RHSA-2026:26610 vendor-advisory
RHSA-2026:26709 vendor-advisory
RHSA-2026:28923 vendor-advisory
RHSA-2026:29844 vendor-advisory
RHSA-2026:36083 vendor-advisory
RHSA-2026:36085 vendor-advisory
RHSA-2026:36086 vendor-advisory
RHSA-2026:36087 vendor-advisory
RHSA-2026:36632 vendor-advisory
RHSA-2026:36633 vendor-advisory
RHSA-2026:36634 vendor-advisory
RHSA-2026:36768 vendor-advisory
RHSA-2026:36791 vendor-advisory
RHSA-2026:36792 vendor-advisory
RHSA-2026:36798 vendor-advisory
RHSA-2026:38502 vendor-advisory
RHSA-2026:38810 vendor-advisory
RHSA-2026:46377 vendor-advisory
RHSA-2026:46382 vendor-advisory
RHSA-2026:46385 vendor-advisory
RHSA-2026:46392 vendor-advisory
RHSA-2026:46456 vendor-advisory
RHSA-2026:46460 vendor-advisory
RHSA-2026:46473 vendor-advisory
RHSA-2026:49519 vendor-advisory
https://access.redhat.com/security/cve/CVE-2026-50263 vdb-entryThird Party Advisory
RHBZ#2485388 issue-trackingIssue TrackingThird Party Advisory
https://gitlab.freedesktop.org/xorg/xserver/-/commit/ecc634f1b2f7aa473d3a267eada98c4918bf9e05 Patch
https://lists.x.org/archives/xorg-announce/2026-June/003702.html Mailing ListVendor Advisory
https://redhat.atlassian.net/browse/PSIRTSUPT-16950 Permissions Required

CPE matches (NVD) (6)

cpe:2.3:a:x.org:x_server:*:*:*:*:*:*:*:* < 21.1.23
cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:* < 24.1.12
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*

CVSS score

5.5Medium

Source: redhat · CVSS 3.1

Attack vector: Local
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

All scores (2)

cna	CVSS 3.1	5.5Medium
secalert@redhat.com	CVSS 3.1	5.5Medium

EPSS (chance of exploitation in 30 days)

0.14%

higher than 3% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: partial

Timeline

ID reserved2026-06-04
Published2026-06-05 13:36
Reached IP-DB2026-10-24 23:46
Last updated2026-11-06 01:18

Assigned by (CNA): redhat
NVD status: Modified

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — Red Hat Enterprise Linux

7.3High

CVE-2026-91151 5 hours ago

Cockpit: cockpit: local privilege escalation via insecure symlink handling in public key addition helper

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9

A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the `ssh-add-public-key.sh` helper. When this helper runs with elevated privileges, it ca…

7.8High

CVE-2026-108472 6 hours ago

Xfsprogs: xfsprogs: local privilege escalation via command injection in xfs_admin

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9

A flaw was found in the xfs_admin utility in xfsprogs. The tool does not properly validate user-supplied parameters, allowing operating system command injection. A local attacker can exploit this issue by providing crafted input arguments, which may result in…

7.5High

CVE-2026-91150 6 hours ago

Cockpit: cockpit: denial of service via unbounded fragmented websocket messages

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9

A flaw was found in Cockpit. This vulnerability allows a remote attacker, without prior authentication, to send specially crafted fragmented WebSocket messages. These messages accumulate without a total-size limit, leading to unbounded memory exhaustion and a…

7.3High

CVE-2026-123747 6 hours ago

Pappl-retrofit: directory traversal in the add-ppdfiles and delete-ppdfiles actions

OpenPrinting pappl-retrofit; Red Hat Red Hat Enterprise Linux 10

A flaw was found in pappl-retrofit. The application fails to properly sanitize user-supplied filenames when handling the upload and deletion of PostScript Printer Description (PPD) files. A remote, unauthenticated attacker can exploit this directory traversal…

5.5Medium

CVE-2026-124746 9 hours ago

Busybox: out-of-bounds read in volume_id_get_buffer() via an offset+length wraparound

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Hardened Images

A flaw was found in BusyBox. An integer overflow occurs in the volume_id component when calculating buffer boundaries while probing filesystem metadata. An attacker can exploit this vulnerability by providing a specially crafted filesystem image on an attache…

6.3Medium

CVE-2026-124745 12 hours ago

Busybox: tar deferred hardlink target resolved through a deferred symlink escapes the extraction directory

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Hardened Images

A flaw was found in BusyBox. When extracting an archive, the tar utility improperly resolves deferred hardlink targets across symbolic links pointing outside the intended extraction directory. An attacker could provide a specially crafted archive that links t…