CVE-2026-56000
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A vulnerability in Xorg server and Xwayland allows local attackers with an X connection to trigger a Heap Use-After-Free via the CommonMakeCurrent() function, which may point to potentially reallocated memory.
Risk Assessment
An attacker could exploit this vulnerability to execute arbitrary code or cause a system crash, compromising confidentiality and integrity.
Recommendation
Immediately update xorg-server to version 21.2.24 or later and xwayland to version 24.1.13 or later.
Other vulnerabilities in Xorg Server
See all- CVE-2026-55999High
A vulnerability in Xorg server and Xwayland before versions 21.2.24 and 24.1.13 allows local attackers with an X connection to cause a heap buffer overflow via the SetFont function using crafted PCX fonts. Missing glyph boundary checks lead to buffer overflow.
- CVE-2023-6478High
A flaw was found in xorg-server that can be triggered by a specially crafted request to RRChangeProviderProperty or RRChangeOutputProperty. This may lead to an integer overflow, potentially resulting in the disclosure of sensitive information.
- CVE-2023-6377High
A flaw was found in xorg-server that allows for out-of-bounds memory reads and writes when querying or changing XKB button actions, such as moving from a touchpad to a mouse. This may lead to local privilege escalation or possible remote code execution in cases where X11 forwarding is involved.
Original NVD description (English source)
Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a Heap Use After Free, due to CommonMakeCurrent() pointing into potentially reallocated memory.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS