CVE-2026-50262

CVE-2026-50262 describes an out-of-bounds read vulnerability affecting the X.Org X server and Xwayland. The flaw resides within the `__glXDisp_ChangeDrawableAttributes()` function, where an improper size validation check permits the reading of a client-controlled number of bytes beyond the allocated request buffer. This vulnerability can lead to information disclosure, as a local user with access to the X server could potentially read sensitive data from the server's process memory. While a write path for this flaw also exists, it is contingent on the use of byte-swapped clients, a configuration that is typically disabled by default.