CVE-2026-56000 | THREATINT

Description

Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a Heap Use After Free, due to CommonMakeCurrent() pointing into potentially reallocated memory.

PUBLISHED Reserved 2026-06-18 | Published 2026-07-08 | Updated 2026-07-08 | Assigner suse

CRITICAL: 9.0CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Problem types

CWE-416 Use after free

Product status

Default status

unaffected

Any version before 21.1.24

affected

Default status

unaffected

Any version before 24.1.13

affected

Credits

Anonymous working with Trend Micro Zero Day Initiative. finder

References

gitlab.freedesktop.org/...fbdb4354e894f490e56f962527d6125043 patch

www.openwall.com/lists/oss-security/2026/07/08/2 vendor-advisory

cve.org (CVE-2026-56000)

nvd.nist.gov (CVE-2026-56000)

Download JSON