Loading vulnerability…
DRI2 Heap Out-of-Bounds Write in X.Org X Server and Xwayland
CVE-2026-50264 is an out-of-bounds heap write vulnerability affecting X.Org X server versions before 21.1.23 and Xwayland versions before 24.1.12. Missing validation of duplicate DRI2 buffer attachment types in do_get_buffers(), reached through DRIGetBuffers and DRIGetBuffersWithFormat, allows a client requesting multiple DRI2BufferBackLeft attachments and one DRI2BufferFrontLeft attachment to disrupt front-buffer accounting and write beyond the allocated buffer array. The resulting heap corruption can crash the server or potentially enable privilege escalation when the X server runs as root.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A local malicious X client can corrupt server heap memory and terminate the X server, disrupting graphical sessions. Successful exploitation of the heap corruption may allow escalation to root on systems running a privileged X server, potentially compromising system confidentiality, integrity, and availability. Reliable privilege escalation may require overcoming ASLR and heap-hardening protections.
If you can’t patch tonight, do this now.
No temporary workaround is specified. Updating the affected packages is recommended.
Patch, then assume compromise.
Upgrade to X.Org X server 21.1.23 or later and Xwayland 24.1.12 or later, or install distribution packages containing backported fixes. Debian trixie addresses the issue in xorg-server 2:21.1.16-1.3+deb13u3. The fixes replace front-buffer counters with boolean tracking, validate attachment counts and values, deduplicate attachment types, and bound allocation sizing by the number of valid unique attachments.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
30 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.