CVE-2026-50262: X.Org Server Information Disclosure Flaw

CVE-2026-50262 Overview

CVE-2026-50262 is an out-of-bounds read vulnerability in the X.Org X server and Xwayland. The flaw resides in the __glXDisp_ChangeDrawableAttributes() function within the GLX extension. An incorrect size validation check allows a local authenticated client to specify a byte count that exceeds the request buffer, causing the server to read adjacent memory. This leads to information disclosure from the X server process address space. A related write path exists but only affects byte-swapped clients, a code path disabled by default in modern X server builds.

Critical Impact
A local attacker connected to the X server can read out-of-bounds memory by sending a crafted ChangeDrawableAttributes GLX request, disclosing sensitive process memory contents.

Affected Products

X.Org X server (xserver) — versions prior to the fixed upstream commit
Xwayland — versions prior to the fixed upstream commit
Linux distributions packaging affected xserver/xwayland builds (see Red Hat advisory)

Discovery Timeline

2026-06-05 - CVE-2026-50262 published to the National Vulnerability Database (NVD)
2026-06-05 - Last updated in NVD database

Technical Details for CVE-2026-50262

Vulnerability Analysis

The vulnerability is classified as an out-of-bounds read [CWE-125] in the GLX (OpenGL extension to X) request dispatch code. The __glXDisp_ChangeDrawableAttributes() handler processes client requests that modify attributes of GLX drawables. The handler validates the size of the attribute list incorrectly, permitting the client to declare a length that extends past the end of the request buffer. The server then reads memory beyond the legitimate request payload while iterating through the attribute pairs.

Because the X server typically runs with elevated privileges and handles input from all clients on the local display, leaked bytes can include session tokens, framebuffer contents, or pointers usable to bypass address space layout randomization (ASLR). The CVSS vector indicates a local attack with low privileges required, high confidentiality impact, and no integrity or availability impact. A write-path variant exists in the byte-swapping code, but byte-swapped client support is disabled by default in current builds.

Root Cause

The root cause is a flawed size validation check in __glXDisp_ChangeDrawableAttributes(). The function compares the declared attribute count against the request length using arithmetic that fails to account for the full size of each attribute pair, allowing client-controlled iteration past the request buffer boundary.

Attack Vector

Exploitation requires a local, authenticated connection to the X server. An attacker submits a crafted GLX ChangeDrawableAttributes request specifying an attribute count larger than the request payload supports. The server reads adjacent heap or stack memory and may return portions of it to the client through subsequent GLX responses or observable side effects.

No verified public proof-of-concept code is available. The fix is published in the upstream xserver repository — see the Xorg Commit Change and the X.org Announcement Archive for technical details.

Detection Methods for CVE-2026-50262

Indicators of Compromise

Unexpected crashes or aborts in Xorg or Xwayland processes coinciding with GLX client activity
Local user processes opening connections to the X display socket (/tmp/.X11-unix/X*) and issuing high volumes of GLX requests
AppArmor, SELinux, or audit denials referencing xserver memory access patterns inconsistent with baseline

Detection Strategies

Inventory installed xserver and xwayland package versions across Linux endpoints and compare against the patched releases from each distribution.
Monitor process telemetry for non-graphical local user accounts spawning binaries that link against libGL or libGLX and connect to the display server.
Correlate X server crash logs in /var/log/Xorg.*.log with the originating client UID to identify abusive local users.

Monitoring Recommendations

Enable verbose logging for the X server during incident response and forward Xorg.*.log files to a centralized log store.
Track endpoint detection and response (EDR) telemetry for anomalous local process behavior interacting with display server sockets.
Alert on installations of unsigned or unexpected GLX client binaries in user-writable directories.

How to Mitigate CVE-2026-50262

Immediate Actions Required

Apply vendor-supplied updates for xserver and xwayland packages from your Linux distribution as soon as they are available.
Restrict local shell and remote desktop access on multi-user systems to trusted accounts until patches are deployed.
Audit which users currently have access to active X display sessions and revoke unnecessary access.

Patch Information

The upstream fix is committed in the X.Org xserver repository at commit 6d459e4daf715bea8abdafa8fb130be2f8a1d145. Distribution-specific updates are tracked in the Red Hat CVE Advisory and the Red Hat Bug Report. Administrators should consult their distribution's security tracker for the corresponding package version.

Workarounds

Where feasible, run graphical sessions under Wayland compositors that do not invoke Xwayland for untrusted clients.
Limit GLX usage on shared multi-user hosts by restricting access to the X display via xhost policies and Unix socket permissions.
Ensure byte-swapped client support remains disabled in the X server configuration to prevent the secondary write-path variant.

bash

# Configuration example: verify and apply patched xserver packages

# Red Hat / Fedora
sudo dnf check-update xorg-x11-server-Xorg xorg-x11-server-Xwayland
sudo dnf update xorg-x11-server-Xorg xorg-x11-server-Xwayland

# Debian / Ubuntu
sudo apt update
sudo apt install --only-upgrade xserver-xorg-core xwayland

# Verify installed version after update
Xorg -version 2>&1 | grep "X.Org X Server"
Xwayland -version 2>&1 | head -n 1

# Restrict X server access to the local user only
xhost -