CVE-2026-56000

HIGH

xorg-x11-server / xwayland GLX contextTags Use-After-Free in CommonMakeCurrent()

Title source: cna

Description

Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a Heap Use After Free, due to CommonMakeCurrent() pointing into potentially reallocated memory.

References (2)

Core 2

Core References

Patch patch

https://gitlab.freedesktop.org/xorg/xserver/-/commit/2779affbdb4354e894f490e56f962527d6125043

Vendor Advisory vendor-advisory

https://www.openwall.com/lists/oss-security/2026/07/08/2

Scores

CVSS v3 7.8

EPSS 0.0022

EPSS Percentile 12.9%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-416

Status published

Products (4)

x.org/x_server < 21.2.24

X.Org/xorg-x11-server < 21.1.24

X.Org/xwayland < 24.1.13

x.org/xwayland < 24.1.13

Published Jul 08, 2026

Tracked Since Jul 08, 2026