{"id":"CVE-2026-50264","summary":"Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: out-of-bounds heap write in dri2 drigetbuffers/drigetbufferswithformat","details":"An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat. A client that requests multiple DRI2BufferBackLeft attachments and one DRI2BufferFrontLeft can trigger an out-of-bounds heap write. This may be used to crash the server, or for privilege escalation if the X server runs as root.","modified":"2026-08-13T11:56:56.221300076Z","published":"2026-06-05T10:36:37.352Z","related":["ALSA-2026:26562","ALSA-2026:26566","ALSA-2026:26590","ALSA-2026:26610","ALSA-2026:26709","ALSA-2026:28923","ALSA-2026:29844"],"database_specific":{"cna_assigner":"redhat","cwe_ids":["CWE-787"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50264.json"},"references":[{"type":"WEB","url":"https://access.redhat.com/downloads/content/package-browser/"},{"type":"WEB","url":"https://lists.x.org/archives/xorg-announce/2026-June/003702.html"},{"type":"WEB","url":"https://redhat.atlassian.net/browse/PSIRTSUPT-16950"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50264.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26562"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26566"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26590"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26610"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26709"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:28923"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:29844"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36083"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36085"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36086"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36087"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36632"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36633"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36634"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36768"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36791"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36792"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36798"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:38502"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:38810"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:46377"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:46382"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:46385"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:46392"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:46456"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:46460"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:46473"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-50264"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50264.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50264"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2485389"},{"type":"FIX","url":"https://gitlab.freedesktop.org/xorg/xserver/-/commit/339c279514326134b0878fc23ce6e9520440ce7f"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://gitlab.freedesktop.org/xorg/xserver","events":[{"introduced":"0"},{"fixed":"8570e9fcec845f68f0c90caa51fd7a24764ea220"},{"fixed":"af4b3d7250366e1a3822919e41fcf66da4966af2"},{"introduced":"0d7ec5c7d9b451066a079fe56bcc9722341a91ff"},{"fixed":"339c279514326134b0878fc23ce6e9520440ce7f"}],"database_specific":{"cpe":["cpe:2.3:a:x.org:x_server:*:*:*:*:*:*:*:*","cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0"},{"fixed":"21.1.23"},{"fixed":"24.1.12"},{"introduced":"7.0"},{"last_affected":"7.0"}],"source":["CPE_RANGE","CPE_STRING","REFERENCES"]}}],"versions":["7.0","xwayland-24.1.11","xorg-server-21.1.22","xwayland-24.1.10","xwayland-24.1.9","xorg-server-21.1.21","xorg-server-21.1.20","xorg-server-21.1.19","xorg-server-21.1.18","xwayland-24.1.8","xwayland-24.1.7","xorg-server-21.1.17","xwayland-24.1.6","xorg-server-21.1.16","xwayland-24.1.5","xorg-server-21.1.15","xwayland-24.1.4","xorg-server-21.1.14","xwayland-24.1.3","xwayland-24.1.2","xwayland-24.1.1","xwayland-24.1.0","xwayland-24.0.99.902","xorg-server-21.1.13","xwayland-24.0.99.901","xorg-server-21.1.12","xorg-server-21.1.11","xorg-server-21.1.10","xorg-server-21.1.9","xorg-server-21.1.8","xorg-server-21.1.7","xorg-server-21.1.6","xorg-server-21.1.5","xorg-server-21.1.4","xorg-server-21.1.3","xorg-server-21.1.2","xorg-server-21.1.1","xorg-server-21.1.0","xorg-server-21.0.99.902","xorg-server-21.0.99.901","xorg-server-21.0.99.1","xorg-server-1.20.0","xorg-server-1.19.99.905","xorg-server-1.19.99.904","xorg-server-1.19.99.903","xorg-server-1.19.99.902","xorg-server-1.19.99.901","xorg-server-1.19.0","xorg-server-1.18.99.902","xorg-server-1.18.99.901","xorg-server-1.18.99.2","xorg-server-1.18.0","xorg-server-1.17.99.902","xorg-server-1.17.99.901","xorg-server-1.17.0","xorg-server-1.16.99.902","xorg-server-1.16.99.901","xorg-server-1.16.0","xorg-server-1.15.99.904","xorg-server-1.15.99.903","xorg-server-1.15.99.902","xorg-server-1.15.99.901","xorg-server-1.15.0","xorg-server-1.14.99.905","xorg-server-1.14.99.904","xorg-server-1.14.99.903","xorg-server-1.14.99.902","xorg-server-1.14.99.901","xorg-server-1.14.99.3","xorg-server-1.14.99.2","xorg-server-1.14.99.1","xorg-server-1.14.0","xorg-server-1.13.99.902","xorg-server-1.13.99.901","xorg-server-1.13.0","xorg-server-1.12.99.905","xorg-server-1.12.99.904","xorg-server-1.12.99.903","xorg-server-1.12.99.902","xorg-server-1.12.99.901","xorg-server-1.12.0","xorg-server-1.11.99.903","xorg-server-1.11.99.902","xorg-server-1.11.99.901","xorg-server-1.11.99.1","xorg-server-1.11.0","xorg-server-1.10.99.902","xorg-server-1.10.99.901","xorg-server-1.10.0","xorg-server-1.9.99.903","xorg-server-1.9.99.902","xorg-server-1.9.99.901","xorg-server-1.9.0","xorg-server-1.8.99.906","xorg-server-1.8.99.905","xorg-server-1.8.99.904","xorg-server-1.8.99.903","xorg-server-1.8.99.902","xorg-server-1.8.99.901","xorg-server-1.8.0","xorg-server-1.7.99.902","xorg-server-1.7.99.901","xorg-server-1.7.99.2","xorg-server-1.7.99.1","xorg-server-1.6.99.901","xorg-server-1.6.99.900","xorg-server-1.5.99.1","xorg-server-1.1.99.3","xorg-server-1_1_99_2","xorg-server-1_0_99_901","XORG-7_0_99_901","xorg-server-1_1_99_1","xorg-server-1_0_99_2","xorg-server-1_0_99_1","XORG-7_0","pre-xgldrop-merge"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50264.json","vanir_signatures_modified":"2026-08-12T16:25:37Z","vanir_signatures":[{"source":"https://gitlab.freedesktop.org/xorg/xserver@339c279514326134b0878fc23ce6e9520440ce7f","target":{"file":"hw/xfree86/dri2/dri2.c"},"deprecated":false,"digest":{"line_hashes":["297112792290904602644888778669495454720","330289514824469994081201747266004895762","97032104450033985776297921584044577041","109230967511801540401343779569058219065","1019301618257969672046360089077559234","54776618040295564930877259211629734235","60325906892556560433973100935750303887","868558710594283455364349593718665089","49279420684199724378323863574297870377","65904884392927776815848850575799517428","232731246414994631801460978650227278018","322383630104674118770187109261737793159","17537867570138085752935126993597836114","176404608047015387164536726342549520648","7398620469875400707014101030785641971","258711250138464909697056944886817449500","31890938645713522799424534504429335032","44775285084384776221153946499677867841","164381845849604020705176339381797116078","235502133809696765442318175560566319227","124690073147458935463480770901484502635","275431563596868115009533967185772409474","48356549252247732302942627982463050031","277821077624352220899554122464274381987","298202072927150487708718683471818110360","94037283485731553482520089455673056989","79698331484379955550542814930905965789","155028332588162220650128575410383733779","183975650571758734337638237790406946736","108129837945897755710266515648776648681","332077249996537164809579786529849341950","275577827473821413106710696239809607494","246570614658161051008922165707441260244","332357970336495090921145650760575056951","133678095347467850626155181059044962627","330924238190273039356113434086633034121","139060810209927507768461044507283433284","17530964017710294939290010416720522488","275231212628067207173314369509158539082","209734147629566407140409029797197472461","278860209069032240003734664214164647576","113888079853336451349742180742220801095","84133425693430511245789583250193264216","1591944608185429181318012605144669695","65533322139816073319497422747983759082","285651393117370011168060770682983231980"],"threshold":0.9},"id":"CVE-2026-50264-491bf00f","signature_type":"Line","signature_version":"v1"},{"target":{"function":"do_get_buffers","file":"hw/xfree86/dri2/dri2.c"},"deprecated":false,"digest":{"length":2184,"function_hash":"94829926601429583588281653798347890887"},"id":"CVE-2026-50264-bacbcf05","signature_type":"Function","signature_version":"v1","source":"https://gitlab.freedesktop.org/xorg/xserver@339c279514326134b0878fc23ce6e9520440ce7f"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}