TI-2026-40395 Aliases CVE-2026-56000 GHSA-4gcc-rqqq-58jp

xorg-x11-server / xwayland GLX contextTags Use-After-Free in CommonMakeCurrent()

MEDIUM 41CWE-416Published 2026-07-08 · Updated 2026-07-08

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: High
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Partial Red Hat: 9 fixed, 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-416 and the CVSS impact.

Summary

Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a Heap Use After Free, due to CommonMakeCurrent() pointing into potentially reallocated memory.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00308 23rd percentileScored 2026-11-07

Fix Partial xorg-x11-server (X.Org): 21.1.24xwayland (X.Org): 24.1.13Red Hat: 5 advisoriesRed Hat: 9 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
x.org	xorg-x11-server	before 21.1.24	21.1.24	Patch available	CNA
x.org	xwayland	before 24.1.13	24.1.13	Patch available	CNA

xorg-x11-server Vendorx.org Affected before 21.1.24 Fixed in 21.1.24 Patch available CNA
xwayland Vendorx.org Affected before 24.1.13 Fixed in 24.1.13 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:x.org:x_server::::::::	before 21.2.24	Vulnerable	x.org
cpe:2.3:a:x.org:xwayland::::::::	before 24.1.13	Vulnerable	x.org

cpe:2.3:a:x.org:x_server:*:*:*:*:*:*:*:* Versions before 21.2.24 Vulnerable ·x.org
cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:* Versions before 24.1.13 Vulnerable ·x.org

Remediation

Fix · CNA xorg-x11-server (X.Org) Fixed in 21.1.24
Fix · CNA xwayland (X.Org) Fixed in 24.1.13

Red Hat 5 advisories

RHSA-2026:52398 Released 2026-08-10 · Red Hat rating Important
xorg-x11-server-Xwayland security update
- Red Hat Enterprise Linux AppStream E4S (v.9.4) xorg-x11-server-Xwayland-22.1.9-8.el9_4.3
RHSA-2026:50718 Released 2026-08-05 · Red Hat rating Important
xorg-x11-server-Xwayland security update
- Red Hat CodeReady Linux Builder EUS (v.9.6) xorg-x11-server-Xwayland-23.2.7-6.el9_6.3, xorg-x11-server-Xwayland-devel-23.2.7-6.el9_6.3
- Red Hat Enterprise Linux AppStream EUS (v.9.6) xorg-x11-server-Xwayland-23.2.7-6.el9_6.3
RHSA-2026:50100 Released 2026-08-04 · Red Hat rating Important
xorg-x11-server-Xwayland security update
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) xorg-x11-server-Xwayland-24.1.5-6.el10_0.2
- Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) xorg-x11-server-Xwayland-devel-24.1.5-6.el10_0.2

Show 2 more Red Hat advisories

RHSA-2026:38490 Released 2026-07-13 · Red Hat rating Important
xorg-x11-server-Xwayland security update
- Red Hat Enterprise Linux AppStream (v. 9) xorg-x11-server-Xwayland-24.1.9-4.el9_8.3
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) xorg-x11-server-Xwayland-24.1.9-4.el9_8.3, xorg-x11-server-Xwayland-devel-24.1.9-4.el9_8.3
RHSA-2026:38489 Released 2026-07-13 · Red Hat rating Important
xorg-x11-server-Xwayland security update
- Red Hat Enterprise Linux AppStream (v. 10) xorg-x11-server-Xwayland-24.1.9-4.el10_2.3
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) xorg-x11-server-Xwayland-devel-24.1.9-4.el10_2.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2026-07-08
X.Org xwayland — openwall.com/lists/oss-security/2026/07/08/2
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-40394 xorg-server / xwayland glamor font atlas Heap Buffer OverflowPriority LOW 39
Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 8	Affected	No fix yet
Red Hat Enterprise Linux 9	Affected	No fix yet
Red Hat CodeReady Linux Builder EUS (v.9.6)	Fixed	RHSA-2026:50718
Red Hat Enterprise Linux AppStream (v. 10)	Fixed	RHSA-2026:38489
Red Hat Enterprise Linux AppStream (v. 9)	Fixed	RHSA-2026:38490
Red Hat Enterprise Linux AppStream E4S (v.9.4)	Fixed	RHSA-2026:52398
Red Hat Enterprise Linux AppStream EUS (v. 10.0)	Fixed	RHSA-2026:50100
Red Hat Enterprise Linux AppStream EUS (v.9.6)	Fixed	RHSA-2026:50718
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)	Fixed	RHSA-2026:38489
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)	Fixed	RHSA-2026:38490
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)	Fixed	RHSA-2026:50100

Not affected: 3 products

Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8

Timeline

2026-10-02 Threatist record created from CVE-2026-56000
2026-10-03 Alias added: GHSA-4gcc-rqqq-58jp

References

Patch 2

TI-2018-10528 A flaw was found in xorg-x11-server before 1.20.3. CVSS 3.0MEDIUM 6.6
TI-2017-08976 Improper input validation in x.org xorg-x11-server CVSS 3.0CRITICAL 9.8
TI-2017-08975 xorg-x11-server before 1.19.5 was missing length validation in MIT-SCREEN-SAVER extension… CVSS 3.0CRITICAL 9.8
TI-2017-08974 Improper input validation in x.org xorg-x11-server CVSS 3.0CRITICAL 9.8
TI-2017-08973 Improper input validation in x.org xorg-x11-server CVSS 3.0CRITICAL 9.8
TI-2017-08972 Improper input validation in x.org xorg-x11-server CVSS 3.0CRITICAL 9.8

See all 96 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences