This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] X.Org X server and Xwayland fix 9 vulnerabilities
X.Org X server version 21.1.23 and Xwayland version 24.1.12 fix 9 vulnerabilities. The most severe ones are listed below. The fixes are also available as commits, a list of which can be found at [1]. Among operating systems, fixes have been released, for example, by Slackware in SSA:2026-154-04 [2] and by Debian for sid in version 2:21.1.23-1 (xorg-server) [3] and for forky, sid in version 2:24.1.12-1 (xwayland) [3].
An authenticated local attacker can crash the server or, if the X server is running as root, escalate privileges due to a stack-based buffer overflow vulnerability when processing font aliases [1][4].
The vulnerability is present in products:
- X server; <21.1.23
- Xwayland; <24.1.12
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-50256 at cve.org, NVD
- CWE-121: Stack-based Buffer Overflow at cwe.mitre.org
The vulnerability was publicly disclosed 4. 6. 2026.
An authenticated local attacker can crash the server or, if the X server is running as root, escalate privileges due to a use-after-free vulnerability in the miSyncDestroyFence() function [1][5].
The vulnerability is present in products:
- X server; <21.1.23
- Xwayland; <24.1.12
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-50257 at cve.org, NVD
- CWE-416: Use After Free at cwe.mitre.org
The vulnerability was publicly disclosed 4. 6. 2026.
An authenticated local attacker can crash the server or, if the X server is running as root, escalate privileges due to a use-after-free vulnerability in the FreeCounter() function [1][6].
The vulnerability is present in products:
- X server; <21.1.23
- Xwayland; <24.1.12
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-50260 at cve.org, NVD
- CWE-416: Use After Free at cwe.mitre.org
The vulnerability was publicly disclosed 4. 6. 2026.
An authenticated local attacker can crash the server or, if the X server is running as root, escalate privileges due to an out-of-bounds heap write vulnerability in the DRIGetBuffers/DRIGetBuffersWithFormat functions [1][7].
The vulnerability is present in products:
- X server; <21.1.23
- Xwayland; <24.1.12
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-50264 at cve.org, NVD
- CWE-787: Out-of-bounds Write at cwe.mitre.org
The vulnerability was publicly disclosed 4. 6. 2026.
Links
- [1] https://lists.x.org/archives/xorg-announce/2026-June/003705.html
- [2] http://www.slackware.com/security/viewer.php?l=slackware-security&y=2026&m=slackware-security.728815
- [3] https://security-tracker.debian.org/tracker/CVE-2026-50256
- [4] https://nvd.nist.gov/vuln/detail/CVE-2026-50256
- [5] https://nvd.nist.gov/vuln/detail/CVE-2026-50257
- [6] https://nvd.nist.gov/vuln/detail/CVE-2026-50260
- [7] https://nvd.nist.gov/vuln/detail/CVE-2026-50264
By CESNET, z.s.p.o. Michaela Jarošová on 8. 6. 2026.