CVE-2026-50263
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
A use-after-free vulnerability was found in the X.Org X server and Xwayland in the CreateSaverWindow() function. A client can trigger a use-after-free read by changing window attributes and forcing the screen saver, leading to information disclosure.
Risk Assessment
The risk involves potential disclosure of sensitive information by an unauthorized client, which could compromise system security and user privacy.
Recommendation
It is recommended to immediately update the X.Org X server and Xwayland to the latest patched version. Additionally, restrict X server access to trusted clients only.
Other vulnerabilities in X.Org X server
See all- CVE-2026-93516Medium
A use-after-free caused by lack of lifecycle management when adding or removing XInput master devices exists in X.org X Server before 21.1.25 and XWayland before 24.1.14. An authenticated X client could exploit this to crash the X server or potentially execute code in the X server context.
- CVE-2026-93515Medium
A use-after-free in present_clear_window_notifies() in X.org X Server before 21.1.25 and XWayland before 24.1.14 could be exploited by malicious X clients to crash the server or potentially execute code in the X server context.
- CVE-2017-10971High
In the X.Org X server before 2017-06-19, a user authenticated to an X Session could crash or execute code in the context of the X Server by exploiting a stack overflow in the endianness conversion of X Events.
- CVE-2026-93536Medium
A use-after-free caused by missing lifecycle management of gesture sprites in GestureBuildSprite() exists in X.Org X Server before 21.1.25 and XWayland before 24.1.14. An authenticated X client could exploit it to crash the X server or potentially execute code.
- CVE-2026-93524Medium
A buffer overread in CheckKeySyms() exists in X.Org X Server before 21.1.25 and XWayland before 24.1.14. An authenticated X client could exploit it to leak small amounts of information from X server memory or potentially crash the X server.
- CVE-2026-93523High
A heap buffer overflow in X.Org X Server before 21.1.15 and XWayland before 24.1.14 is triggered by an XIPassiveUngrabDevice request with an out-of-range modifier value. An authenticated X client could exploit this to crash the X server or potentially execute code in the server context.
- CVE-2026-93522High
A heap buffer overflow caused by mismatched size usage in the CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14. Authenticated X clients could use it to crash the server or potentially execute code in the X server context.
- CVE-2026-93521High
A buffer overflow in RandR ChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14. Authenticated X clients could use it to crash the server or execute code within the X server context.
- CVE-2026-93520High
A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange exists in X.org X server before 2.1.25 and XWayland before 24.1.14. Authenticated X clients could exploit it to crash or potentially execute code in the X server context.
- CVE-2026-93519High
A buffer overflow when handling pointer barriers in the XFIXES extension exists in X.Org X server before 21.1.25 and XWayland before 24.1.14. Authenticated X clients could exploit it to crash or potentially execute code in the X server context.
Original NVD description (English source)
A use-after-free flaw was found in the X.Org X server and Xwayland in CreateSaverWindow(). A client can trigger a use-after-free read after changing window attributes and forcing the screen saver, leading to information disclosure.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS