Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-06-02T00:00:00 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds heap write in DRI2 DRIGetBuffers/DRIGetBuffersWithFormat 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE-787

An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat. A client that requests multiple DRI2BufferBackLeft attachments and one DRI2BufferFrontLeft can trigger an out-of-bounds heap write. This may be used to crash the server, or for privilege escalation if the X server runs as root.

Red Hat rates this issue as Important impact. In xorg-x11-server and xorg-x11-server-Xwayland, a local X client that requests multiple DRI2BufferBackLeft attachments together with DRI2BufferFrontLeft can trigger an out-of-bounds heap write in DRIGetBuffers/DRIGetBuffersWithFormat. Any local user with X display access can trigger this. It may crash the server or, where the X server runs with elevated privileges, could contribute to local privilege escalation. Upstream fixed this in xorg-server 21.1.23 and xwayland 24.1.12. This issue was discovered by Peter Hutterer (Red Hat). Red Hat Enterprise Linux 10 2026-06-22T00:00:00Z RHSA-2026:26566 xorg-x11-server-Xwayland-0:24.1.9-4.el10_2.2 Red Hat Enterprise Linux 10.0 Extended Update Support 2026-07-08T00:00:00Z RHSA-2026:36798 xorg-x11-server-Xwayland-0:24.1.5-6.el10_0.1 Red Hat Enterprise Linux 7 Extended Lifecycle Support 2026-07-07T00:00:00Z RHSA-2026:36083 xorg-x11-server-0:1.20.4-35.el7_9 Red Hat Enterprise Linux 7 Extended Lifecycle Support 2026-07-27T00:00:00Z RHSA-2026:46473 tigervnc-0:1.8.0-36.el7_9.5 Red Hat Enterprise Linux 8 2026-06-17T00:00:00Z RHSA-2026:26562 xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.2 Red Hat Enterprise Linux 8 2026-06-17T00:00:00Z RHSA-2026:26709 xorg-x11-server-0:1.20.11-28.el8_10.2 Red Hat Enterprise Linux 8 2026-06-24T00:00:00Z RHSA-2026:28923 tigervnc-0:1.15.0-10.el8_10 Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 2026-07-08T00:00:00Z RHSA-2026:36792 xorg-x11-server-0:1.20.10-5.el8_4 Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 2026-07-27T00:00:00Z RHSA-2026:46382 tigervnc-0:1.11.0-8.el8_4.16 Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 2026-07-08T00:00:00Z RHSA-2026:36792 xorg-x11-server-0:1.20.10-5.el8_4 Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 2026-07-27T00:00:00Z RHSA-2026:46382 tigervnc-0:1.11.0-8.el8_4.16 Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 2026-07-08T00:00:00Z RHSA-2026:36791 xorg-x11-server-0:1.20.11-8.el8_6 Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 2026-07-13T00:00:00Z RHSA-2026:38810 xorg-x11-server-Xwayland-0:21.1.3-2.el8_6.7 Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 2026-07-27T00:00:00Z RHSA-2026:46460 tigervnc-0:1.12.0-6.el8_6.18 Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 2026-07-08T00:00:00Z RHSA-2026:36791 xorg-x11-server-0:1.20.11-8.el8_6 Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 2026-07-13T00:00:00Z RHSA-2026:38810 xorg-x11-server-Xwayland-0:21.1.3-2.el8_6.7 Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 2026-07-27T00:00:00Z RHSA-2026:46460 tigervnc-0:1.12.0-6.el8_6.18 Red Hat Enterprise Linux 8.8 Telecommunications Update Service 2026-07-08T00:00:00Z RHSA-2026:36768 xorg-x11-server-0:1.20.11-19.el8_8 Red Hat Enterprise Linux 8.8 Telecommunications Update Service 2026-07-13T00:00:00Z RHSA-2026:38502 xorg-x11-server-Xwayland-0:21.1.3-13.el8_8.1 Red Hat Enterprise Linux 8.8 Telecommunications Update Service 2026-07-27T00:00:00Z RHSA-2026:46385 tigervnc-0:1.12.0-15.el8_8.18 Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 2026-07-08T00:00:00Z RHSA-2026:36768 xorg-x11-server-0:1.20.11-19.el8_8 Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 2026-07-13T00:00:00Z RHSA-2026:38502 xorg-x11-server-Xwayland-0:21.1.3-13.el8_8.1 Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 2026-07-27T00:00:00Z RHSA-2026:46385 tigervnc-0:1.12.0-15.el8_8.18 Red Hat Enterprise Linux 9 2026-06-17T00:00:00Z RHSA-2026:26590 xorg-x11-server-Xwayland-0:24.1.9-4.el9_8.2 Red Hat Enterprise Linux 9 2026-06-17T00:00:00Z RHSA-2026:26610 xorg-x11-server-0:1.20.11-34.el9_8.2 Red Hat Enterprise Linux 9 2026-06-25T00:00:00Z RHSA-2026:29844 tigervnc-0:1.15.0-7.el9_8.2 Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 2026-07-07T00:00:00Z RHSA-2026:36086 xorg-x11-server-0:1.20.11-21.el9_2 Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 2026-07-08T00:00:00Z RHSA-2026:36633 xorg-x11-server-Xwayland-0:21.1.3-10.el9_2.1 Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 2026-07-27T00:00:00Z RHSA-2026:46377 tigervnc-0:1.12.0-14.el9_2.15 Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 2026-07-07T00:00:00Z RHSA-2026:36087 xorg-x11-server-0:1.20.11-29.el9_4 Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 2026-07-08T00:00:00Z RHSA-2026:36632 xorg-x11-server-Xwayland-0:22.1.9-8.el9_4.1 Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 2026-07-27T00:00:00Z RHSA-2026:46456 tigervnc-0:1.13.1-8.el9_4.10 Red Hat Enterprise Linux 9.6 Extended Update Support 2026-07-07T00:00:00Z RHSA-2026:36085 xorg-x11-server-0:1.20.11-34.el9_6 Red Hat Enterprise Linux 9.6 Extended Update Support 2026-07-08T00:00:00Z RHSA-2026:36634 xorg-x11-server-Xwayland-0:23.2.7-6.el9_6.1 Red Hat Enterprise Linux 9.6 Extended Update Support 2026-07-27T00:00:00Z RHSA-2026:46392 tigervnc-0:1.14.1-11.el9_6 Red Hat Enterprise Linux 6 Affected tigervnc Red Hat Enterprise Linux 6 Out of support scope xorg-x11-server https://www.cve.org/CVERecord?id=CVE-2026-50264 https://nvd.nist.gov/vuln/detail/CVE-2026-50264 https://gitlab.freedesktop.org/xorg/xserver/-/commit/339c279514326134b0878fc23ce6e9520440ce7f https://lists.x.org/archives/xorg-announce/2026-June/003702.html https://redhat.atlassian.net/browse/PSIRTSUPT-16950