CVE-2026-50264: Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: out-of-bounds heap write in dri2 drigetbuffers/drigetbufferswithformat

Synopsis

An out-of-bounds heap write vulnerability exists in the X.Org X server and Xwayland, specifically in the DRI2 buffer handling functions DRIGetBuffers and DRIGetBuffersWithFormat. A local attacker with a low-privilege account can trigger the flaw by requesting multiple DRI2BufferBackLeft attachments alongside a DRI2BufferFrontLeft, causing a write past the end of a heap allocation. Successful exploitation crashes the X server or enables privilege escalation to root if the X server runs with root privileges. No upstream fix has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available the moment a fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or local process on the host; no network access to the service is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to open a connection to the X server and send the malformed DRI2 buffer request.

• Victim interactionNot required

  No interaction from another user or process is needed; the attacker sends the request directly to the X server.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or specific memory layout prerequisites are documented for triggering the out-of-bounds write.

Blast Radius

• The X server process crashes, disrupting all graphical sessions and any applications depending on the display.
• If the X server runs as root (a common configuration on older RHEL versions), the attacker gains root-level code execution on the host.
• An attacker with root access reads any file on the system, including stored credentials, secrets, and application data.
• An attacker with root access modifies or deletes arbitrary files, including binaries and configuration, enabling persistent backdoor installation.