X.Org and Xwayland patch nine memory-safety flaws with root-level impact

X.Org disclosed nine security vulnerabilities in the X server and Xwayland and released fixes in xorg-server 21.1.23 and xwayland 24.1.12. The bugs, later assigned CVE-2026-50256 through CVE-2026-50264, affect versions prior to those releases and span multiple subsystems including libXfont2/font alias handling, XSYNC, XKB, GLX, screensaver code, and DRI2. Reported impacts include crashes, information disclosure, memory corruption, and possible privilege escalation where the X server runs as root; some reports also note potential remote code execution exposure in environments using SSH X11 forwarding. Most issues were reported by an anonymous researcher working with TrendAI Zero Day Initiative, while one DRI2 flaw was credited to Peter Hutterer of Red Hat.

The fixes address several distinct bug classes: a stack-based buffer overflow caused by a font-name length mismatch during alias resolution, multiple use-after-free conditions in XSYNC object teardown and CreateSaverWindow, stricter GLX request-size validation to stop malformed client requests from reaching unsafe paths, and DRI2 hardening to validate and deduplicate buffer attachments before allocation and processing. One disclosed flaw, tracked as CVE-2026-50256, allows any client able to connect to the server to trigger a font-alias overflow that could lead to denial of service or elevated impact on root-run servers. Red Hat separately rated affected X.Org server packages as Important across supported RHEL releases, underscoring the need to update exposed X.Org and Xwayland deployments.