CVE-2026-56000

9.0 criticalEPSS 0.3%

Critical (9.0) in x.org. EPSS 0.3% chance of exploitation in the next 30 days.

Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a Heap Use After Free, due to CommonMakeCurrent() pointing into potentially reallocated memory.

Severity

CVSS 4.0

9.0 critical

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CVSS 3.1

7.8 high

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 23% of CVEs (scores of 2026-10-31)
CWE: CWE-416
Published: 2026-07-08
Modified: 2026-07-09
Record from: the NVD, synced 2026-10-19

Affected

x.org:x_server
x.org:xwayland

References

https://gitlab.freedesktop.org/xorg/xserver/-/commit/2779affbdb4354e894f490e56f962527d6125043
https://www.openwall.com/lists/oss-security/2026/07/08/2

Check your stack JSON