CVE-2026-56000

HighCVSS 7.8

Published: 08/07/2026(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

9th percentile - higher than 9% of all known CVEs

Summary

A vulnerability in Xorg server and Xwayland allows local attackers with an X connection to trigger a Heap Use-After-Free via the CommonMakeCurrent() function, which may point to potentially reallocated memory.

Risk Assessment

An attacker could exploit this vulnerability to execute arbitrary code or cause a system crash, compromising confidentiality and integrity.

Recommendation

Immediately update xorg-server to version 21.2.24 or later and xwayland to version 24.1.13 or later.

Original NVD description (English source)

Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a Heap Use After Free, due to CommonMakeCurrent() pointing into potentially reallocated memory.