CVE-2026-50262

An out-of-bounds read flaw was found in the X.Org X server and Xwayland in __glXDisp_ChangeDrawableAttributes(). A wrong size validation check can read a client-controlled number of bytes, exceeding the request buffer, leading to information disclosure. A write path also exists but requires byte-swapped clients which is disabled by default.
References
Link Resource
https://access.redhat.com/errata/RHSA-2026:26562
https://access.redhat.com/errata/RHSA-2026:26566
https://access.redhat.com/errata/RHSA-2026:26590
https://access.redhat.com/errata/RHSA-2026:26610
https://access.redhat.com/errata/RHSA-2026:26709
https://access.redhat.com/errata/RHSA-2026:28923
https://access.redhat.com/errata/RHSA-2026:29844
https://access.redhat.com/errata/RHSA-2026:36083
https://access.redhat.com/errata/RHSA-2026:36085
https://access.redhat.com/errata/RHSA-2026:36086
https://access.redhat.com/errata/RHSA-2026:36087
https://access.redhat.com/errata/RHSA-2026:36632
https://access.redhat.com/errata/RHSA-2026:36633
https://access.redhat.com/errata/RHSA-2026:36634
https://access.redhat.com/errata/RHSA-2026:36768
https://access.redhat.com/errata/RHSA-2026:36791
https://access.redhat.com/errata/RHSA-2026:36792
https://access.redhat.com/errata/RHSA-2026:36798
https://access.redhat.com/errata/RHSA-2026:38502
https://access.redhat.com/errata/RHSA-2026:38810
https://access.redhat.com/errata/RHSA-2026:46377
https://access.redhat.com/errata/RHSA-2026:46382
https://access.redhat.com/errata/RHSA-2026:46385
https://access.redhat.com/errata/RHSA-2026:46392
https://access.redhat.com/errata/RHSA-2026:46456
https://access.redhat.com/errata/RHSA-2026:46460
https://access.redhat.com/errata/RHSA-2026:46473
https://access.redhat.com/errata/RHSA-2026:49519
https://access.redhat.com/security/cve/CVE-2026-50262 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2485387 Issue Tracking Vendor Advisory
https://gitlab.freedesktop.org/xorg/xserver/-/commit/6d459e4daf715bea8abdafa8fb130be2f8a1d145 Patch
https://lists.x.org/archives/xorg-announce/2026-June/003702.html Mailing List Vendor Advisory
https://redhat.atlassian.net/browse/PSIRTSUPT-16950 Permissions Required
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:x.org:x_server:*:*:*:*:*:*:*:*
cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*

History

05 Aug 2026, 00:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:49519 -

27 Jul 2026, 10:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:46385 -
  • () https://access.redhat.com/errata/RHSA-2026:46392 -
  • () https://access.redhat.com/errata/RHSA-2026:46473 -

27 Jul 2026, 08:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:46460 -

27 Jul 2026, 07:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:46456 -

27 Jul 2026, 04:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:46377 -
  • () https://access.redhat.com/errata/RHSA-2026:46382 -

13 Jul 2026, 12:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:38810 -

13 Jul 2026, 06:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:38502 -

08 Jul 2026, 20:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:36768 -
  • () https://access.redhat.com/errata/RHSA-2026:36798 -

08 Jul 2026, 17:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:36791 -
  • () https://access.redhat.com/errata/RHSA-2026:36792 -

08 Jul 2026, 10:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:36632 -
  • () https://access.redhat.com/errata/RHSA-2026:36633 -
  • () https://access.redhat.com/errata/RHSA-2026:36634 -

07 Jul 2026, 12:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:36083 -
  • () https://access.redhat.com/errata/RHSA-2026:36085 -
  • () https://access.redhat.com/errata/RHSA-2026:36087 -

07 Jul 2026, 08:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:36086 -

25 Jun 2026, 14:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:29844 -

24 Jun 2026, 11:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:28923 -

22 Jun 2026, 08:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:26566 -

18 Jun 2026, 02:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:26562 -
  • () https://access.redhat.com/errata/RHSA-2026:26590 -
  • () https://access.redhat.com/errata/RHSA-2026:26610 -
  • () https://access.redhat.com/errata/RHSA-2026:26709 -

15 Jun 2026, 13:40

Type Values Removed Values Added
References () https://access.redhat.com/security/cve/CVE-2026-50262 - () https://access.redhat.com/security/cve/CVE-2026-50262 - Vendor Advisory
References () https://bugzilla.redhat.com/show_bug.cgi?id=2485387 - () https://bugzilla.redhat.com/show_bug.cgi?id=2485387 - Issue Tracking, Vendor Advisory
References () https://gitlab.freedesktop.org/xorg/xserver/-/commit/6d459e4daf715bea8abdafa8fb130be2f8a1d145 - () https://gitlab.freedesktop.org/xorg/xserver/-/commit/6d459e4daf715bea8abdafa8fb130be2f8a1d145 - Patch
References () https://lists.x.org/archives/xorg-announce/2026-June/003702.html - () https://lists.x.org/archives/xorg-announce/2026-June/003702.html - Mailing List, Vendor Advisory
References () https://redhat.atlassian.net/browse/PSIRTSUPT-16950 - () https://redhat.atlassian.net/browse/PSIRTSUPT-16950 - Permissions Required
CPE cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:a:x.org:x_server:*:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
First Time Redhat enterprise Linux
Redhat
X.org
X.org xwayland
X.org x Server

05 Jun 2026, 12:16

Type Values Removed Values Added
New CVE

Information

Published : 2026-06-05 12:16

Updated : 2026-08-05 00:17


NVD link : CVE-2026-50262

Mitre link : CVE-2026-50262

CVE.ORG link : CVE-2026-50262


JSON object : View

Products Affected

x.org

  • x_server
  • xwayland

redhat

  • enterprise_linux
CWE
CWE-125

Out-of-bounds Read