GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

RHSA-2026:26562

Vulnerability from csaf_opensuse - Published: 2026-06-17 00:00 - Updated: 2026-09-16 18:30
Summary
security update for xorg-x11-server-Xwayland
Severity
Important
Notes
Title of the patch: security update for xorg-x11-server-Xwayland
Description of the patch: This security update provides a functional equivalent of RHSA-2026:26562. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2026:26562.
Patchnames: RHSA-2026:26562
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2026-50256
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Product Identifier Version Remediation
Unresolved product id: SUSE Liberty Linux 8:xorg-x11-server-Xwayland-21.1.3-20.el8_10.2.x86_64 —
Vendor Fix
Threats
Impact important
CVE-2026-50257
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Recommended 1 product, the same list as for CVE-2026-50256
Threats
Impact important
CVE-2026-50258
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Recommended 1 product, the same list as for CVE-2026-50256
Threats
Impact important
CVE-2026-50259
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Recommended 1 product, the same list as for CVE-2026-50256
Threats
Impact important
CVE-2026-50260
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Recommended 1 product, the same list as for CVE-2026-50256
Threats
Impact important
CVE-2026-50261
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Recommended 1 product, the same list as for CVE-2026-50256
Threats
Impact important
CVE-2026-50262
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
Recommended 1 product, the same list as for CVE-2026-50256
Threats
Impact moderate
CVE-2026-50263
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
Recommended 1 product, the same list as for CVE-2026-50256
Threats
Impact moderate
CVE-2026-50264
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Recommended 1 product, the same list as for CVE-2026-50256
Threats
Impact important
References
URL Category
https://www.suse.com/support/security/rating/ external
https://ftp.suse.com/pub/projects/security/csaf/r… self
https://lists.suse.com/pipermail/suse-liberty-lin… self
https://lists.suse.com/pipermail/suse-liberty-lin… self
https://www.suse.com/security/cve/CVE-2026-50256/ self
https://www.suse.com/security/cve/CVE-2026-50257/ self
https://www.suse.com/security/cve/CVE-2026-50258/ self
https://www.suse.com/security/cve/CVE-2026-50259/ self
https://www.suse.com/security/cve/CVE-2026-50260/ self
https://www.suse.com/security/cve/CVE-2026-50261/ self
https://www.suse.com/security/cve/CVE-2026-50262/ self
https://www.suse.com/security/cve/CVE-2026-50263/ self
https://www.suse.com/security/cve/CVE-2026-50264/ self
https://www.suse.com/security/cve/CVE-2026-50256 external
https://bugzilla.suse.com/1266294 external
https://bugzilla.suse.com/1274575 external
https://www.suse.com/security/cve/CVE-2026-50257 external
https://bugzilla.suse.com/1266295 external
https://bugzilla.suse.com/1274575 external
https://www.suse.com/security/cve/CVE-2026-50258 external
https://bugzilla.suse.com/1266296 external
https://bugzilla.suse.com/1274575 external
https://www.suse.com/security/cve/CVE-2026-50259 external
https://bugzilla.suse.com/1266297 external
https://bugzilla.suse.com/1274575 external
https://www.suse.com/security/cve/CVE-2026-50260 external
https://bugzilla.suse.com/1266298 external
https://bugzilla.suse.com/1274575 external
https://www.suse.com/security/cve/CVE-2026-50261 external
https://bugzilla.suse.com/1266299 external
https://bugzilla.suse.com/1274575 external
https://www.suse.com/security/cve/CVE-2026-50262 external
https://bugzilla.suse.com/1266300 external
https://bugzilla.suse.com/1274575 external
https://www.suse.com/security/cve/CVE-2026-50263 external
https://bugzilla.suse.com/1266301 external
https://bugzilla.suse.com/1274575 external
https://www.suse.com/security/cve/CVE-2026-50264 external
https://bugzilla.suse.com/1266302 external
https://bugzilla.suse.com/1274575 external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "security update for xorg-x11-server-Xwayland",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This security update provides a functional equivalent of RHSA-2026:26562.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2026:26562.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "RHSA-2026:26562",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2026_26562.json"
      },
      {
        "category": "self",
        "summary": "URL for RHSA-2026:26562",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-June/006653.html"
      },
      {
        "category": "self",
        "summary": "E-Mail link for RHSA-2026:26562",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-June/006653.html"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-50256 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-50256/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-50257 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-50257/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-50258 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-50258/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-50259 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-50259/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-50260 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-50260/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-50261 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-50261/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-50262 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-50262/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-50263 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-50263/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-50264 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-50264/"
      }
    ],
    "title": "security update for xorg-x11-server-Xwayland",
    "tracking": {
      "current_release_date": "2026-09-16T18:30:49Z",
      "generator": {
        "date": "2026-06-17T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "RHSA-2026:26562",
      "initial_release_date": "2026-06-17T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-06-17T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-16T17:50:19Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-16T18:30:49Z",
          "number": "3",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xorg-x11-server-Xwayland-21.1.3-20.el8_10.2.x86_64",
                "product": {
                  "name": "xorg-x11-server-Xwayland-21.1.3-20.el8_10.2.x86_64",
                  "product_id": "xorg-x11-server-Xwayland-21.1.3-20.el8_10.2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/xorg-x11-server-Xwayland@21.1.3-20.el8_10.2?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Liberty Linux 8",
                "product": {
                  "name": "SUSE Liberty Linux 8",
                  "product_id": "SUSE Liberty Linux 8",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sll:8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-Xwayland-21.1.3-20.el8_10.2.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:xorg-x11-server-Xwayland-21.1.3-20.el8_10.2.x86_64"
        },
        "product_reference": "xorg-x11-server-Xwayland-21.1.3-20.el8_10.2.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-50256",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-50256"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library\u0027s maximum font name length can cause a stack buffer overflow during font alias resolution. The server allocates a 256 byte stack buffer but libXfont2\u0027s alias target name length is 1024 bytes. A font alias name between 257 and 1023 bytes causes the X server to copy that name into the undersized stack buffer without further checks. This may be used to crash the server, or for privilege escalation if the X server runs as root.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:xorg-x11-server-Xwayland-21.1.3-20.el8_10.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-50256",
          "url": "https://www.suse.com/security/cve/CVE-2026-50256"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266294 for CVE-2026-50256",
          "url": "https://bugzilla.suse.com/1266294"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1274575 for CVE-2026-50256",
          "url": "https://bugzilla.suse.com/1274575"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:xorg-x11-server-Xwayland-21.1.3-20.el8_10.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:xorg-x11-server-Xwayland-21.1.3-20.el8_10.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-17T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-50256"
    },
    {
      "cve": "CVE-2026-50257",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-50257"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence(). A client that sets up multiple fence triggers can trigger a use-after-free function pointer call. An attacker would connect to the X server to set up a fence and await that fence, then a second X connection destroys the fence, causing the use-after-free. This may be used to crash the server, or for privilege escalation if the X server runs as root.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:xorg-x11-server-Xwayland-21.1.3-20.el8_10.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-50257",
          "url": "https://www.suse.com/security/cve/CVE-2026-50257"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266295 for CVE-2026-50257",
          "url": "https://bugzilla.suse.com/1266295"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1274575 for CVE-2026-50257",
          "url": "https://bugzilla.suse.com/1274575"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:xorg-x11-server-Xwayland-21.1.3-20.el8_10.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:xorg-x11-server-Xwayland-21.1.3-20.el8_10.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-17T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-50257"
    },
    {
      "cve": "CVE-2026-50258",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-50258"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. The X server has multiple stack buffers sized XkbMaxShiftLevel * XkbNumKbdGroups but CheckKeyTypes() does not verify or clamp non-canonical key types to XkbMaxShiftLevel. A client can change key types to excessive shift levels and trigger stack overflows. This is caused by an incomplete fix of CVE-2025-26597. This may be used to crash the server, or for privilege escalation if the X server runs as root.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:xorg-x11-server-Xwayland-21.1.3-20.el8_10.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-50258",
          "url": "https://www.suse.com/security/cve/CVE-2026-50258"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266296 for CVE-2026-50258",
          "url": "https://bugzilla.suse.com/1266296"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1274575 for CVE-2026-50258",
          "url": "https://bugzilla.suse.com/1274575"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:xorg-x11-server-Xwayland-21.1.3-20.el8_10.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:xorg-x11-server-Xwayland-21.1.3-20.el8_10.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-17T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-50258"
    },
    {
      "cve": "CVE-2026-50259",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-50259"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. _XkbSetMapChecks() declares a fixed-size stack buffer mapWidths[256] indexed by key type index. The helper function CheckKeyTypes() writes to this buffer at a client-controlled offset, allowing a stack buffer overflow. This may be used to crash the server, or for privilege escalation if the X server runs as root.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:xorg-x11-server-Xwayland-21.1.3-20.el8_10.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-50259",
          "url": "https://www.suse.com/security/cve/CVE-2026-50259"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266297 for CVE-2026-50259",
          "url": "https://bugzilla.suse.com/1266297"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1274575 for CVE-2026-50259",
          "url": "https://bugzilla.suse.com/1274575"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:xorg-x11-server-Xwayland-21.1.3-20.el8_10.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:xorg-x11-server-Xwayland-21.1.3-20.el8_10.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-17T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-50259"
    },
    {
      "cve": "CVE-2026-50260",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-50260"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A use-after-free flaw was found in the X.Org X server and Xwayland in FreeCounter(). A client that sets up multiple SyncCounters and awaits on those triggers can trigger a use-after-free when destroying those counters via a second client connection. This may be used to crash the server, or for privilege escalation if the X server runs as root.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:xorg-x11-server-Xwayland-21.1.3-20.el8_10.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-50260",
          "url": "https://www.suse.com/security/cve/CVE-2026-50260"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266298 for CVE-2026-50260",
          "url": "https://bugzilla.suse.com/1266298"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1274575 for CVE-2026-50260",
          "url": "https://bugzilla.suse.com/1274575"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:xorg-x11-server-Xwayland-21.1.3-20.el8_10.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:xorg-x11-server-Xwayland-21.1.3-20.el8_10.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-17T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-50260"
    },
    {
      "cve": "CVE-2026-50261",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-50261"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A use-after-free flaw was found in the X.Org X server and Xwayland in SyncChangeCounter(). A client that sets up multiple SyncCounters can trigger a use-after-free when destroying those counters via a second client connection while changing those counters. This may be used to crash the server, or for privilege escalation if the X server runs as root.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:xorg-x11-server-Xwayland-21.1.3-20.el8_10.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-50261",
          "url": "https://www.suse.com/security/cve/CVE-2026-50261"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266299 for CVE-2026-50261",
          "url": "https://bugzilla.suse.com/1266299"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1274575 for CVE-2026-50261",
          "url": "https://bugzilla.suse.com/1274575"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:xorg-x11-server-Xwayland-21.1.3-20.el8_10.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:xorg-x11-server-Xwayland-21.1.3-20.el8_10.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-17T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-50261"
    },
    {
      "cve": "CVE-2026-50262",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-50262"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An out-of-bounds read flaw was found in the X.Org X server and Xwayland in __glXDisp_ChangeDrawableAttributes(). A wrong size validation check can read a client-controlled number of bytes, exceeding the request buffer, leading to information disclosure. A write path also exists but requires byte-swapped clients which is disabled by default.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:xorg-x11-server-Xwayland-21.1.3-20.el8_10.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-50262",
          "url": "https://www.suse.com/security/cve/CVE-2026-50262"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266300 for CVE-2026-50262",
          "url": "https://bugzilla.suse.com/1266300"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1274575 for CVE-2026-50262",
          "url": "https://bugzilla.suse.com/1274575"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:xorg-x11-server-Xwayland-21.1.3-20.el8_10.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:xorg-x11-server-Xwayland-21.1.3-20.el8_10.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-17T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-50262"
    },
    {
      "cve": "CVE-2026-50263",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-50263"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A use-after-free flaw was found in the X.Org X server and Xwayland in CreateSaverWindow(). A client can trigger a use-after-free read after changing window attributes and forcing the screen saver, leading to information disclosure.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:xorg-x11-server-Xwayland-21.1.3-20.el8_10.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-50263",
          "url": "https://www.suse.com/security/cve/CVE-2026-50263"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266301 for CVE-2026-50263",
          "url": "https://bugzilla.suse.com/1266301"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1274575 for CVE-2026-50263",
          "url": "https://bugzilla.suse.com/1274575"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:xorg-x11-server-Xwayland-21.1.3-20.el8_10.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:xorg-x11-server-Xwayland-21.1.3-20.el8_10.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-17T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-50263"
    },
    {
      "cve": "CVE-2026-50264",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-50264"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat. A client that requests multiple DRI2BufferBackLeft attachments and one DRI2BufferFrontLeft can trigger an out-of-bounds heap write. This may be used to crash the server, or for privilege escalation if the X server runs as root.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:xorg-x11-server-Xwayland-21.1.3-20.el8_10.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-50264",
          "url": "https://www.suse.com/security/cve/CVE-2026-50264"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266302 for CVE-2026-50264",
          "url": "https://bugzilla.suse.com/1266302"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1274575 for CVE-2026-50264",
          "url": "https://bugzilla.suse.com/1274575"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:xorg-x11-server-Xwayland-21.1.3-20.el8_10.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:xorg-x11-server-Xwayland-21.1.3-20.el8_10.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-17T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-50264"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.