Loading vulnerability…
Out-of-bounds read/write in X.Org Server and Xwayland GLX ChangeDrawableAttributes
CVE-2026-50262 is an out-of-bounds memory access vulnerability in the GLX __glXDisp_ChangeDrawableAttributes() function in X.Org Server before 21.1.23 and Xwayland before 24.1.12. Incorrect request-size validation allows a client-controlled byte count to exceed the request buffer, causing an out-of-bounds read and information disclosure. An out-of-bounds write path also exists but requires support for byte-swapped clients, which is disabled by default.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation can disclose information from server memory through out-of-bounds reads. If byte-swapped clients are enabled, the write path can corrupt memory and crash the server, potentially enabling privilege escalation when the X server runs as root.
If you can’t patch tonight, do this now.
Restrict access to affected X.Org Server and Xwayland instances to trusted clients, or disable affected instances where practical until patched. Keep support for byte-swapped clients disabled to prevent access to the write path; this does not mitigate the out-of-bounds read.
Patch, then assume compromise.
Upgrade to X.Org Server 21.1.23 or later, Xwayland 24.1.12 or later, or distribution packages containing the backported fix. Debian stable (trixie) users should install xorg-server version 2:21.1.16-1.3+deb13u3 or later. XLibre users should upgrade to version 25.1.6 or later.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
25 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.