PT-2026-46943 · X.Org Foundation+1 · Xwayland+2

CVE-2026-50263 · Published 2026-04-20 · Updated 2026-07-27

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions X.Org X server (affected versions not specified) Xwayland (affected versions not specified)

Description A use-after-free flaw exists in the CreateSaverWindow() function. A client can trigger a use-after-free read by changing window attributes and forcing the screen saver, which may result in information disclosure. Use-after-free is a condition where a program continues to use a pointer after it has been freed, potentially allowing access to memory that has been repurposed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALSA-2026:26562

ALSA-2026:26590

ALSA-2026:26610

ALSA-2026:26709

ALSA-2026:28923

ALSA-2026:29844

BDU:2026-08149

CVE-2026-50263

ECHO-4456-5962-A3CB

OESA-2026-2681

ZDI-26-397

Affected Products

Rocky Linux

X.Org Server

Xwayland

References · 119

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50263.json · Exploit
• https://cve.org/CVERecord?id=CVE-2026-50263 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-50263 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2681 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-50256 · Security Note
• https://gitlab.freedesktop.org/xorg/xserver/-/commit/ecc634f1b2f7aa473d3a267eada98c4918bf9e05 · Patch
• https://osv.dev/vulnerability/ALSA-2026:26709 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:26566 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:26590 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2026-26610.html · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:26709 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-50263 · Security Note
• https://errata.rockylinux.org/RLSA-2026:28923 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-50262 · Security Note
• https://access.redhat.com/errata/RHSA-2026:36087 · Vendor Advisory