CVE-2026-50263

5.5 MEDIUM

Published: June 05, 2026 Modified: June 11, 2026

Description

A use-after-free flaw was found in the X.Org X server and Xwayland in CreateSaverWindow(). A client can trigger a use-after-free read after changing window attributes and forcing the screen saver, leading to information disclosure.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

CVSS v3.x Details

0.0 Low Medium High Critical 10.0

Vector String

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

https://access.redhat.com/security/cve/CVE-2026-50263

Source: secalert@redhat.com

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2485388

Source: secalert@redhat.com

Issue Tracking Third Party Advisory

https://gitlab.freedesktop.org/xorg/xserver/-/commit/ecc634f1b2f7aa473d3a267eada98c4918bf9e05

Source: secalert@redhat.com

Patch

https://lists.x.org/archives/xorg-announce/2026-June/003702.html

Source: secalert@redhat.com

Mailing List Vendor Advisory

https://redhat.atlassian.net/browse/PSIRTSUPT-16950

Source: secalert@redhat.com

Permissions Required

5 reference(s) from NVD

Quick Stats

CVSS v3 Score

5.5 / 10.0

EPSS (Exploit Probability)

0.2%

8th percentile

Exploitation Status

Not in CISA KEV

Weaknesses (CWE)

CWE-416

Affected Vendors

x.org redhat

Related CVEs