CVE-2026-50262: Red Hat Enterprise Linux

Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days.

An out-of-bounds read flaw was found in the X.Org X server and Xwayland in __glXDisp_ChangeDrawableAttributes(). A wrong size validation check can read a client-controlled number of bytes, exceeding the request buffer, leading to information disclosure. A write path also exists but requires byte-swapped clients which is disabled by default.

Affected products

• Red Hat Enterprise Linux: version 7.0 only; version 8.0 only; version 9.0 only; version 10.0 only
• X.org X Server: before 21.1.23 (fixed in 21.1.23)
• X.org Xwayland: before 24.1.12 (fixed in 24.1.12)

Published 2026-06-05. Last modified 2026-08-05.