CVE-2026-56000: X.org X Server

High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days.

Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a Heap Use After Free, due to CommonMakeCurrent() pointing into potentially reallocated memory.

Affected products

• X.org X Server: before 21.2.24 (fixed in 21.2.24)
• X.org Xwayland: before 24.1.13 (fixed in 24.1.13)

Published 2026-07-08. Last modified 2026-07-09.