Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2026-50264: X.Org X server may crash or allow privilege gain
CVE-2026-50264 · published 5 months ago
Summary
The X.Org X server and Xwayland components in several Linux distributions can be made to write data outside of its memory space when a specially crafted request is sent. This can cause the display server to stop working or, if it is running with high privileges, let an attacker gain elevated rights. Update to the latest packages from your Linux vendor or apply their security patches as soon as possible.
What to do
- Update debian xwayland to version 2:24.1.12-1.
- Update bellsoft xorg-server to version 21.1.23-r0.
- Update xorg-server to version 2:21.1.7-3+deb12u12.aikido.8.
- Update rootio-xorg-server to version 2:21.1.7-3+deb12u12.aikido.8.
- Update debian rootio-xorg-server to version 2:1.20.11-1+deb11u17.root.io.7.
- Update debian rootio-xorg-server to version 2:1.20.11-1+deb11u17.root.io.9.
- Update debian rootio-xorg-server to version 2:21.1.7-3+deb12u12.root.io.6.
- Update debian xorg-server to version 2:21.1.7-3+deb12u12.aikido.8.
- Update debian rootio-xorg-server to version 2:21.1.7-3+deb12u12.aikido.8.
- Update debian xorg-server to version 2:21.1.7-3+deb12u13.
- Update debian xorg-server to version 2:21.1.16-1.3+deb13u3.
- Update debian xorg-server to version 2:21.1.23-1.
- Update xorg-server to version 2:1.20.11-1+deb11u13.aikido.11.
- Update rootio-xorg-server to version 2:1.20.11-1+deb11u13.aikido.11.
- Update xorg-server to version 2:1.20.11-1+deb11u13.aikido.12.
- Update rootio-xorg-server to version 2:1.20.11-1+deb11u13.aikido.12.
- Update x.org x_server to version 21.1.23 or later.
- Update x.org xwayland to version 24.1.12 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:26.04:LTS | canonical | xwayland | All versions |
| – | red hat | red hat enterprise linux 6 | All versions |
| – | red hat | red hat enterprise linux 7 | All versions |
| Debian:11 | debian | xorg-server | All versions |
| Debian:12 | debian | xorg-server |
< 2:21.1.7-3+deb12u13 Fix: upgrade to 2:21.1.7-3+deb12u13
|
| Debian:13 | debian | xorg-server |
< 2:21.1.16-1.3+deb13u3 Fix: upgrade to 2:21.1.16-1.3+deb13u3
|
| Debian:14 | debian | xorg-server |
< 2:21.1.23-1 Fix: upgrade to 2:21.1.23-1
|
| Debian:12 | debian | xwayland | All versions |
| Debian:13 | debian | xwayland | All versions |
| Debian:14 | debian | xwayland |
< 2:24.1.12-1 Fix: upgrade to 2:24.1.12-1
|
| Ubuntu:Pro:14.04:LTS | canonical | xorg-server | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | xorg-server | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | xorg-server-hwe-16.04 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | xorg-server | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | xorg-server-hwe-18.04 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | xorg-server | All versions |
| Ubuntu:22.04:LTS | canonical | xorg-server | All versions |
| Ubuntu:22.04:LTS | canonical | xwayland | All versions |
| Ubuntu:24.04:LTS | canonical | xorg-server | All versions |
| Ubuntu:24.04:LTS | canonical | xwayland | All versions |
| Ubuntu:25.10 | canonical | xorg-server | All versions |
| Ubuntu:25.10 | canonical | xwayland | All versions |
| Ubuntu:26.04:LTS | canonical | xorg-server | All versions |
| Alpaquita:23 | bellsoft | xorg-server |
>= 21.1.4-r1, < 21.1.23-r0 Fix: upgrade to 21.1.23-r0
|
| Alpaquita:25 | bellsoft | xorg-server |
>= 21.1.16-r0, < 21.1.23-r0 Fix: upgrade to 21.1.23-r0
|
| Alpaquita:stream | bellsoft | xorg-server |
>= 21.1.4-r1, < 21.1.23-r0 Fix: upgrade to 21.1.23-r0
|
| – | red hat | red hat enterprise linux 10 | All versions |
| – | red hat | red hat enterprise linux 7 extended lifecycle support | All versions |
| – | red hat | red hat enterprise linux 8 | All versions |
| – | red hat | red hat enterprise linux 9 | All versions |
| – | red hat | red hat enterprise linux 9.2 update services for sap solutions | All versions |
| – | red hat | red hat enterprise linux 9.4 update services for sap solutions | All versions |
| – | red hat | red hat enterprise linux 9.6 extended update support | All versions |
| – | x.org | x_server |
< 21.1.23 cpe:2.3:a:x.org:x_server:*:*:*:*:*:*:*:* |
| – | x.org | xwayland |
< 24.1.12 cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:* |
| – | redhat | enterprise_linux |
7.0 8.0 9.0 10.0 cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* |
| – | red hat | red hat enterprise linux 8.6 advanced mission critical update support | All versions |
| – | red hat | red hat enterprise linux 8.6 extended update support long-life add-on | All versions |
| – | red hat | red hat enterprise linux 8.4 advanced mission critical update support | All versions |
| – | red hat | red hat enterprise linux 8.4 extended update support long-life add-on | All versions |
| – | red hat | red hat enterprise linux 10.0 extended update support | All versions |
| – | red hat | red hat enterprise linux 8.8 telecommunications update service | All versions |
| – | red hat | red hat enterprise linux 8.8 update services for sap solutions | All versions |
| Root:Debian:12 | – | xorg-server |
< 2:21.1.7-3+deb12u12.aikido.8 Fix: upgrade to 2:21.1.7-3+deb12u12.aikido.8
|
| Root:Debian:12 | – | rootio-xorg-server |
< 2:21.1.7-3+deb12u12.aikido.8 Fix: upgrade to 2:21.1.7-3+deb12u12.aikido.8
|
| Root:Debian:11 | debian | rootio-xorg-server |
< 2:1.20.11-1+deb11u17.root.io.7 < 2:1.20.11-1+deb11u17.root.io.9 Fix: upgrade to 2:1.20.11-1+deb11u17.root.io.7
|
| Root:Debian:12 | debian | rootio-xorg-server |
< 2:21.1.7-3+deb12u12.root.io.6 < 2:21.1.7-3+deb12u12.aikido.8 Fix: upgrade to 2:21.1.7-3+deb12u12.root.io.6
|
| Root:Debian:12 | debian | xorg-server |
< 2:21.1.7-3+deb12u12.aikido.8 Fix: upgrade to 2:21.1.7-3+deb12u12.aikido.8
|
| Root:Debian:11 | – | xorg-server |
< 2:1.20.11-1+deb11u13.aikido.11 < 2:1.20.11-1+deb11u13.aikido.12 Fix: upgrade to 2:1.20.11-1+deb11u13.aikido.11
|
| Root:Debian:11 | – | rootio-xorg-server |
< 2:1.20.11-1+deb11u13.aikido.11 < 2:1.20.11-1+deb11u13.aikido.12 Fix: upgrade to 2:1.20.11-1+deb11u13.aikido.11
|
Original advisory text
Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: out-of-bounds heap write in dri2 drigetbuffers/drigetbufferswithformat
An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat. A client that requests multiple DRI2BufferBackLeft attachments and one DRI2BufferFrontLeft can trigger an out-of-bounds heap write. This may be used to crash the server, or for privilege escalation if the X server runs as root.
References
- https://security-tracker.debian.org/tracker/CVE-2026-50264 Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-50264 Third Party Advisory
- https://www.openwall.com/lists/oss-security/2026/06/02/1 Third Party Advisory
- https://docs.bell-sw.com/security/cves/CVE-2026-50264 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:36798
- https://access.redhat.com/errata/RHSA-2026:38810
- https://access.redhat.com/downloads/content/package-browser/ URL
- https://access.redhat.com/security/cve/CVE-2026-50264 Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50264... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-50264 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:46377
- https://access.redhat.com/errata/RHSA-2026:46456
- https://access.redhat.com/errata/RHSA-2026:46460
- https://access.redhat.com/errata/RHSA-2026:46473
- https://access.redhat.com/errata/RHSA-2026:26562
- https://bugzilla.redhat.com/show_bug.cgi?id=2485389 Issue Tracking Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:26566
- https://access.redhat.com/errata/RHSA-2026:26590
- https://access.redhat.com/errata/RHSA-2026:26709
- https://access.redhat.com/errata/RHSA-2026:28923
- https://ubuntu.com/security/CVE-2026-50264 Third Party Advisory
- https://gitlab.freedesktop.org/xorg/xserver/-/commit/b7aa65cc3bb11b792ce2a3f511b... Third Party Advisory
- https://gitlab.freedesktop.org/xorg/xserver/-/commit/339c279514326134b0878fc23ce... Patch
- https://access.redhat.com/errata/RHSA-2026:36083
- https://access.redhat.com/errata/RHSA-2026:36792
- https://access.redhat.com/errata/RHSA-2026:38502
- https://access.redhat.com/errata/RHSA-2026:46392
- https://lists.x.org/archives/xorg-announce/2026-June/003702.html Mailing List Vendor Advisory
- https://redhat.atlassian.net/browse/PSIRTSUPT-16950 Permissions Required
- https://access.redhat.com/errata/RHSA-2026:26610
- https://access.redhat.com/errata/RHSA-2026:29844
- https://access.redhat.com/errata/RHSA-2026:36085
- https://access.redhat.com/errata/RHSA-2026:36086
- https://access.redhat.com/errata/RHSA-2026:36087
- https://access.redhat.com/errata/RHSA-2026:36632
- https://access.redhat.com/errata/RHSA-2026:36633
- https://access.redhat.com/errata/RHSA-2026:36634
- https://access.redhat.com/errata/RHSA-2026:36768
- https://access.redhat.com/errata/RHSA-2026:36791
- https://access.redhat.com/errata/RHSA-2026:46382
- https://access.redhat.com/errata/RHSA-2026:46385
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50264.json
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-787Out-of-bounds Write
Timeline
Published5 Jun 2026
Updated5 Nov 2026
First seen5 Jun 2026
Sources
DEBIAN-CVE-2026-50264 · OSV
UBUNTU-CVE-2026-50264 · OSV
BELL-CVE-2026-50264 · OSV
CVE-2026-50264 · NVD
CVE-2026-50264 · MITRE
CVE-2026-50264 · OSV
Track software like this
Free during beta