Loading vulnerability…
Use-after-free information disclosure in X.Org and Xwayland CreateSaverWindow()
CVE-2026-50263 is a use-after-free read vulnerability in CreateSaverWindow() in X.Org X server versions before 21.1.23 and Xwayland versions before 24.1.12. A connected client can trigger access to freed memory by changing window attributes and forcing screen-saver activation, potentially disclosing information from the server process.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can disclose information through a read of freed server memory. The vulnerability is rated as having high confidentiality impact, with no integrity or availability impact in its CVSS v3.0 assessment. Code execution and privilege escalation are not established for this specific vulnerability.
If you can’t patch tonight, do this now.
No temporary workaround is documented. Apply the vendor-provided xorg-server or Xwayland updates.
Patch, then assume compromise.
Upgrade X.Org X server to 21.1.23 or later and Xwayland to 24.1.12 or later, or install distribution packages containing backported fixes. For Debian stable (trixie), upgrade xorg-server packages to 2:21.1.16-1.3+deb13u3 or later. XLibre users should upgrade to 25.1.6 or later. Update affected vendor-packaged X server components, including applicable TigerVNC packages, through the relevant distribution security updates.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
25 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.