{"id":"CVE-2026-56000","aliases":["ALPINE-CVE-2026-56000","ALSA-2026:38489","ALSA-2026:38490","AZL-92072","AZL-92265","BELL-CVE-2026-56000","CLSA-2026-1784219693","DEBIAN-CVE-2026-56000","EUVD-2026-42202","GHSA-4gcc-rqqq-58jp","MGASA-2026-0303","RHSA-2026:38489","RHSA-2026:38490","RHSA-2026:50100","RHSA-2026:50718","RHSA-2026:52398","RLSA-2026:38489","RLSA-2026:38490","ROOT-OS-DEBIAN-11-CVE-2026-56000","ROOT-OS-DEBIAN-12-CVE-2026-56000","SUSE-SU-2026:22617-1","SUSE-SU-2026:2786-1","SUSE-SU-2026:2787-1","SUSE-SU-2026:2788-1","SUSE-SU-2026:2789-1","SUSE-SU-2026:2791-1","UBUNTU-CVE-2026-56000","openSUSE-SU-2026:11227-1","openSUSE-SU-2026:11244-1","openSUSE-SU-2026:21273-1","openSUSE-SU-2026:21283-1"],"status":"published","title":"xorg-x11-server / xwayland GLX contextTags Use-After-Free in CommonMakeCurrent()","description":"Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a Heap Use After Free, due to CommonMakeCurrent() pointing into potentially reallocated memory.","severity":{"version":"4.0","score":9,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00308,"percentile":0.23912,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2026-07-08T00:00:00Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"xorg-server","fixed_in":["21.1.24-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"xwayland","fixed_in":["24.1.13-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"xorg-x11-server-Xwayland","fixed_in":["24.1.13-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"xorg-server","fixed_in":["21.1.24-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"xorg-server","fixed_in":["21.1.24-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"xorg-server","fixed_in":["21.1.24-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xorg-server","fixed_in":["2:21.1.16-1.3+deb13u4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xorg-server","fixed_in":["2:21.1.24-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xwayland","fixed_in":["2:24.1.13-1"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"xorg-server","fixed_in":["2:1.20.11-1+deb11u18.aikido.13"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-xorg-server","fixed_in":["2:1.20.11-1+deb11u18.aikido.13"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"xorg-server","fixed_in":["2:21.1.7-3+deb12u13.aikido.9"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-xorg-server","fixed_in":["2:21.1.7-3+deb12u13.aikido.9"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.24-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.1.13-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"xorg-x11-server-Xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.1.9-4.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"xorg-x11-server-Xwayland-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.1.9-4.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"xorg-x11-server-Xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.1.9-4.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"xorg-x11-server-Xwayland-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.1.9-4.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Azure Linux:3","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.20.10-6"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"xorg-x11-server-Xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.1.13-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"21.1.4-r1"},{"fixed":"21.1.24-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"21.1.16-r0"},{"fixed":"21.1.24-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"21.1.4-r1"},{"fixed":"21.1.24-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"xorg-x11-server-Xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.2.7-5.el9_6.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"xorg-x11-server-Xwayland-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.2.7-5.el9_6.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:21.1.10-1","2:21.1.11-1","2:21.1.11-2","2:21.1.11-3","2:21.1.12-1","2:21.1.13-1","2:21.1.13-2","2:21.1.13-3","2:21.1.13-3.1","2:21.1.14-1","2:21.1.14-2","2:21.1.15-1","2:21.1.15-2","2:21.1.15-3","2:21.1.16-1","2:21.1.16-1.1","2:21.1.16-1.2","2:21.1.16-1.3","2:21.1.18-1","2:21.1.18-2","2:21.1.20-1","2:21.1.21-1","2:21.1.22-1","2:21.1.23-1","2:21.1.24-1","2:21.1.7-3","2:21.1.7-3+deb12u1","2:21.1.7-3+deb12u10","2:21.1.7-3+deb12u11","2:21.1.7-3+deb12u12","2:21.1.7-3+deb12u13","2:21.1.7-3+deb12u2","2:21.1.7-3+deb12u3","2:21.1.7-3+deb12u4","2:21.1.7-3+deb12u5","2:21.1.7-3+deb12u6","2:21.1.7-3+deb12u7","2:21.1.7-3+deb12u8","2:21.1.7-3+deb12u9","2:21.1.8-1","2:21.1.9-1","2:21.1.9-1+hurd.1"]},{"source":"osv","ecosystem":"Debian:13","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:21.1.16-1.3+deb13u4"}]}],"versions":["2:21.1.16-1.3","2:21.1.16-1.3+deb13u1","2:21.1.16-1.3+deb13u2","2:21.1.16-1.3+deb13u3"]},{"source":"osv","ecosystem":"Debian:14","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:21.1.24-1"}]}],"versions":["2:21.1.16-1.3","2:21.1.18-1","2:21.1.18-2","2:21.1.20-1","2:21.1.21-1","2:21.1.22-1","2:21.1.23-1"]},{"source":"osv","ecosystem":"Debian:12","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:22.1.9-1","2:23.1.0-1","2:23.1.1-1","2:23.2.0-1","2:23.2.1-1","2:23.2.2-1","2:23.2.3-1","2:23.2.4-1","2:23.2.6-1","2:24.0.99.901-1","2:24.1.0-1","2:24.1.10-1","2:24.1.11-1","2:24.1.12-1","2:24.1.13-1","2:24.1.2-1","2:24.1.3-1","2:24.1.4-1","2:24.1.4-2","2:24.1.4-3","2:24.1.5-1","2:24.1.6-1","2:24.1.8-1","2:24.1.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:24.1.10-1","2:24.1.11-1","2:24.1.12-1","2:24.1.13-1","2:24.1.6-1","2:24.1.8-1","2:24.1.9-1"]},{"source":"osv","ecosystem":"Debian:14","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:24.1.13-1"}]}],"versions":["2:24.1.10-1","2:24.1.11-1","2:24.1.12-1","2:24.1.6-1","2:24.1.8-1","2:24.1.9-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.24-1.mga10"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:10","package":"x11-server-xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.1.13-1.mga10"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:10","package":"tigervnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.0-7.1.mga10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"xorg-x11-server-Xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.1.9-4.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"xorg-x11-server-Xwayland-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.1.9-4.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"xorg-x11-server-Xwayland-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.1.9-4.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"xorg-x11-server-Xwayland-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.1.9-4.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"xorg-x11-server-Xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.1.9-4.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"xorg-x11-server-Xwayland-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.1.9-4.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"xorg-x11-server-Xwayland-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.1.9-4.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"xorg-x11-server-Xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.1.9-4.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"xorg-x11-server-Xwayland-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.1.9-4.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"xorg-x11-server-Xwayland-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.1.9-4.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"xorg-x11-server-Xwayland-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.1.9-4.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"xorg-x11-server-Xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.1.5-6.el10_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"xorg-x11-server-Xwayland-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.1.5-6.el10_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"xorg-x11-server-Xwayland-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.1.5-6.el10_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"xorg-x11-server-Xwayland-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.1.5-6.el10_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"xorg-x11-server-Xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.2.7-6.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"xorg-x11-server-Xwayland-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.2.7-6.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"xorg-x11-server-Xwayland-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.2.7-6.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"xorg-x11-server-Xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.2.7-6.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"xorg-x11-server-Xwayland-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.2.7-6.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"xorg-x11-server-Xwayland-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.2.7-6.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"xorg-x11-server-Xwayland-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.2.7-6.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"xorg-x11-server-Xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.1.9-8.el9_4.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"xorg-x11-server-Xwayland-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.1.9-8.el9_4.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"xorg-x11-server-Xwayland-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.1.9-8.el9_4.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"xorg-x11-server-Xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.1.9-4.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"xorg-x11-server-Xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.1.9-4.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Root:Debian:11","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.11-1+deb11u18.aikido.13"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.11-1+deb11u18.aikido.13"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:21.1.7-3+deb12u13.aikido.9"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:21.1.7-3+deb12u13.aikido.9"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.1.6-160000.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.1.6-160000.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.11-150600.5.31.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.11-150600.5.31.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.1.5-150700.3.22.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.15-150700.5.22.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.15-150700.5.22.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150400.38.74.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150400.38.74.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150400.38.74.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150400.38.74.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.4-150500.7.52.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.4-150500.7.52.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.4-150500.7.52.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.4-150500.7.52.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.14.3-3ubuntu2","2:1.14.3-3ubuntu3","2:1.14.3-3ubuntu4","2:1.14.3-5ubuntu1","2:1.14.4-1ubuntu1","2:1.14.4-1ubuntu2","2:1.14.4.901-0ubuntu2","2:1.14.5-1ubuntu2","2:1.14.5-1ubuntu4","2:1.15.0-1ubuntu1","2:1.15.0-1ubuntu2","2:1.15.0-1ubuntu3","2:1.15.0-1ubuntu4","2:1.15.0-1ubuntu6","2:1.15.0-1ubuntu7","2:1.15.1-0ubuntu1","2:1.15.1-0ubuntu2","2:1.15.1-0ubuntu2.1","2:1.15.1-0ubuntu2.4","2:1.15.1-0ubuntu2.5","2:1.15.1-0ubuntu2.6","2:1.15.1-0ubuntu2.7","2:1.15.1-0ubuntu2.9","2:1.15.1-0ubuntu2.10","2:1.15.1-0ubuntu2.11","2:1.15.1-0ubuntu2.11+esm2","2:1.15.1-0ubuntu2.11+esm3","2:1.15.1-0ubuntu2.11+esm4","2:1.15.1-0ubuntu2.11+esm5","2:1.15.1-0ubuntu2.11+esm6","2:1.15.1-0ubuntu2.11+esm7","2:1.15.1-0ubuntu2.11+esm8","2:1.15.1-0ubuntu2.11+esm9","2:1.15.1-0ubuntu2.11+esm11","2:1.15.1-0ubuntu2.11+esm12"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.17.2-1ubuntu9","2:1.17.2-1ubuntu10","2:1.17.3-2ubuntu1","2:1.17.3-2ubuntu2","2:1.17.3-2ubuntu3","2:1.17.3-2ubuntu4","2:1.18.1-1ubuntu3","2:1.18.1-1ubuntu4","2:1.18.3-1ubuntu1","2:1.18.3-1ubuntu2","2:1.18.3-1ubuntu2.2","2:1.18.3-1ubuntu2.3","2:1.18.4-0ubuntu0.1","2:1.18.4-0ubuntu0.2","2:1.18.4-0ubuntu0.3","2:1.18.4-0ubuntu0.4","2:1.18.4-0ubuntu0.6","2:1.18.4-0ubuntu0.7","2:1.18.4-0ubuntu0.8","2:1.18.4-0ubuntu0.9","2:1.18.4-0ubuntu0.10","2:1.18.4-0ubuntu0.11","2:1.18.4-0ubuntu0.12","2:1.18.4-0ubuntu0.12+esm1","2:1.18.4-0ubuntu0.12+esm2","2:1.18.4-0ubuntu0.12+esm4","2:1.18.4-0ubuntu0.12+esm5","2:1.18.4-0ubuntu0.12+esm6","2:1.18.4-0ubuntu0.12+esm8","2:1.18.4-0ubuntu0.12+esm9","2:1.18.4-0ubuntu0.12+esm10","2:1.18.4-0ubuntu0.12+esm12","2:1.18.4-0ubuntu0.12+esm13","2:1.18.4-0ubuntu0.12+esm14","2:1.18.4-0ubuntu0.12+esm15","2:1.18.4-0ubuntu0.12+esm16","2:1.18.4-0ubuntu0.12+esm17","2:1.18.4-0ubuntu0.12+esm18"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"xorg-server-hwe-16.04","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.18.4-1ubuntu6.1~16.04.1","2:1.18.4-1ubuntu6.1~16.04.2","2:1.19.3-1ubuntu1~16.04.2","2:1.19.3-1ubuntu1~16.04.3","2:1.19.3-1ubuntu1~16.04.4","2:1.19.5-0ubuntu2~16.04.1","2:1.19.6-1ubuntu4~16.04.1","2:1.19.6-1ubuntu4.1~16.04.1","2:1.19.6-1ubuntu4.1~16.04.2","2:1.19.6-1ubuntu4.1~16.04.3","2:1.19.6-1ubuntu4.1~16.04.4","2:1.19.6-1ubuntu4.1~16.04.5","2:1.19.6-1ubuntu4.1~16.04.6","2:1.19.6-1ubuntu4.1~16.04.6+esm1","2:1.19.6-1ubuntu4.1~16.04.6+esm3","2:1.19.6-1ubuntu4.1~16.04.6+esm4","2:1.19.6-1ubuntu4.1~16.04.6+esm5","2:1.19.6-1ubuntu4.1~16.04.6+esm6","2:1.19.6-1ubuntu4.1~16.04.6+esm7","2:1.19.6-1ubuntu4.1~16.04.6+esm8","2:1.19.6-1ubuntu4.1~16.04.6+esm9","2:1.19.6-1ubuntu4.1~16.04.6+esm10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.19.5-0ubuntu2","2:1.19.6-1ubuntu1","2:1.19.6-1ubuntu2","2:1.19.6-1ubuntu3","2:1.19.6-1ubuntu4","2:1.19.6-1ubuntu4.1","2:1.19.6-1ubuntu4.2","2:1.19.6-1ubuntu4.3","2:1.19.6-1ubuntu4.4","2:1.19.6-1ubuntu4.5","2:1.19.6-1ubuntu4.6","2:1.19.6-1ubuntu4.7","2:1.19.6-1ubuntu4.8","2:1.19.6-1ubuntu4.9","2:1.19.6-1ubuntu4.10","2:1.19.6-1ubuntu4.11","2:1.19.6-1ubuntu4.12","2:1.19.6-1ubuntu4.13","2:1.19.6-1ubuntu4.14","2:1.19.6-1ubuntu4.15","2:1.19.6-1ubuntu4.15+esm1","2:1.19.6-1ubuntu4.15+esm3","2:1.19.6-1ubuntu4.15+esm4","2:1.19.6-1ubuntu4.15+esm5","2:1.19.6-1ubuntu4.15+esm7","2:1.19.6-1ubuntu4.15+esm8","2:1.19.6-1ubuntu4.15+esm9","2:1.19.6-1ubuntu4.15+esm10","2:1.19.6-1ubuntu4.15+esm11","2:1.19.6-1ubuntu4.15+esm12","2:1.19.6-1ubuntu4.15+esm13"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"xorg-server-hwe-18.04","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.20.1-3ubuntu2.1~18.04.1","2:1.20.4-1ubuntu3~18.04.1","2:1.20.5+git20191008-0ubuntu1~18.04.1","2:1.20.8-2ubuntu2.1~18.04.1","2:1.20.8-2ubuntu2.2~18.04.1","2:1.20.8-2ubuntu2.2~18.04.2","2:1.20.8-2ubuntu2.2~18.04.3","2:1.20.8-2ubuntu2.2~18.04.4","2:1.20.8-2ubuntu2.2~18.04.5","2:1.20.8-2ubuntu2.2~18.04.6","2:1.20.8-2ubuntu2.2~18.04.7","2:1.20.8-2ubuntu2.2~18.04.8","2:1.20.8-2ubuntu2.2~18.04.9","2:1.20.8-2ubuntu2.2~18.04.10","2:1.20.8-2ubuntu2.2~18.04.11","2:1.20.8-2ubuntu2.2~18.04.11+esm1","2:1.20.8-2ubuntu2.2~18.04.11+esm2","2:1.20.8-2ubuntu2.2~18.04.11+esm3","2:1.20.8-2ubuntu2.2~18.04.11+esm4","2:1.20.8-2ubuntu2.2~18.04.11+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.20.5+git20191008-0ubuntu1","2:1.20.6-1ubuntu1","2:1.20.7-2ubuntu1","2:1.20.7-2ubuntu2","2:1.20.8-2ubuntu2","2:1.20.8-2ubuntu2.1","2:1.20.8-2ubuntu2.2","2:1.20.8-2ubuntu2.3","2:1.20.8-2ubuntu2.4","2:1.20.8-2ubuntu2.6","2:1.20.9-2ubuntu1.1~20.04.1","2:1.20.9-2ubuntu1.2~20.04.1","2:1.20.9-2ubuntu1.2~20.04.2","2:1.20.11-1ubuntu1~20.04.2","2:1.20.13-1ubuntu1~20.04.2","2:1.20.13-1ubuntu1~20.04.3","2:1.20.13-1ubuntu1~20.04.4","2:1.20.13-1ubuntu1~20.04.5","2:1.20.13-1ubuntu1~20.04.6","2:1.20.13-1ubuntu1~20.04.8","2:1.20.13-1ubuntu1~20.04.9","2:1.20.13-1ubuntu1~20.04.12","2:1.20.13-1ubuntu1~20.04.14","2:1.20.13-1ubuntu1~20.04.15","2:1.20.13-1ubuntu1~20.04.16","2:1.20.13-1ubuntu1~20.04.17","2:1.20.13-1ubuntu1~20.04.18","2:1.20.13-1ubuntu1~20.04.19","2:1.20.13-1ubuntu1~20.04.20","2:1.20.13-1ubuntu1~20.04.20+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.20.13-1ubuntu1","2:1.20.13-1ubuntu2","2:1.20.14-1ubuntu1","2:21.1.3-2ubuntu2","2:21.1.3-2ubuntu2.1","2:21.1.3-2ubuntu2.2","2:21.1.3-2ubuntu2.3","2:21.1.3-2ubuntu2.4","2:21.1.3-2ubuntu2.5","2:21.1.3-2ubuntu2.6","2:21.1.3-2ubuntu2.7","2:21.1.3-2ubuntu2.8","2:21.1.3-2ubuntu2.9","2:21.1.4-2ubuntu1.7~22.04.1","2:21.1.4-2ubuntu1.7~22.04.2","2:21.1.4-2ubuntu1.7~22.04.5","2:21.1.4-2ubuntu1.7~22.04.7","2:21.1.4-2ubuntu1.7~22.04.8","2:21.1.4-2ubuntu1.7~22.04.9","2:21.1.4-2ubuntu1.7~22.04.10","2:21.1.4-2ubuntu1.7~22.04.11","2:21.1.4-2ubuntu1.7~22.04.12","2:21.1.4-2ubuntu1.7~22.04.13","2:21.1.4-2ubuntu1.7~22.04.14","2:21.1.4-2ubuntu1.7~22.04.15","2:21.1.4-2ubuntu1.7~22.04.16"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:21.1.2-0ubuntu1","2:21.1.3-1","2:21.1.3-1ubuntu1","2:21.1.4-1","2:22.1.0-1","2:22.1.1-1","2:22.1.1-1ubuntu0.1","2:22.1.1-1ubuntu0.2","2:22.1.1-1ubuntu0.3","2:22.1.1-1ubuntu0.4","2:22.1.1-1ubuntu0.5","2:22.1.1-1ubuntu0.6","2:22.1.1-1ubuntu0.7","2:22.1.1-1ubuntu0.9","2:22.1.1-1ubuntu0.10","2:22.1.1-1ubuntu0.11","2:22.1.1-1ubuntu0.12","2:22.1.1-1ubuntu0.13","2:22.1.1-1ubuntu0.14","2:22.1.1-1ubuntu0.15","2:22.1.1-1ubuntu0.17","2:22.1.1-1ubuntu0.18","2:22.1.1-1ubuntu0.19","2:22.1.1-1ubuntu0.20"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:21.1.7-3ubuntu2","2:21.1.7-3ubuntu2.1","2:21.1.10-1ubuntu1","2:21.1.11-2ubuntu1","2:21.1.12-1ubuntu1","2:21.1.12-1ubuntu1.1","2:21.1.12-1ubuntu1.2","2:21.1.12-1ubuntu1.3","2:21.1.12-1ubuntu1.4","2:21.1.12-1ubuntu1.5","2:21.1.12-1ubuntu1.6","2:21.1.12-1ubuntu1.8","2:21.1.12-1ubuntu1.9"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:23.2.0-1","2:23.2.0-1ubuntu0.1","2:23.2.3-1","2:23.2.4-1","2:23.2.4-1build1","2:23.2.4-1build2","2:23.2.4-1build3","2:23.2.6-1","2:23.2.6-1ubuntu0.1","2:23.2.6-1ubuntu0.2","2:23.2.6-1ubuntu0.4","2:23.2.6-1ubuntu0.5","2:23.2.6-1ubuntu0.6","2:23.2.6-1ubuntu0.7","2:23.2.6-1ubuntu0.8"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:21.1.16-1ubuntu1","2:21.1.18-1ubuntu1","2:21.1.18-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:24.1.6-1","2:24.1.6-1ubuntu1","2:24.1.6-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:21.1.22-1ubuntu1","2:21.1.22-1ubuntu4","2:21.1.24-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:24.1.10-1","2:24.1.12-1","2:24.1.13-1","2:24.1.14-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:21.1.18-1ubuntu1","2:21.1.21-1ubuntu1","2:21.1.22-1ubuntu1","2:21.1.22-1ubuntu1.2","2:21.1.22-1ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:24.1.6-1ubuntu1","2:24.1.8-1","2:24.1.9-1","2:24.1.10-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.1.12-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.21-8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.15-160000.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.1.6-160000.6.1"}]}],"bundled":2}],"products":[{"vendor":"the xorg project","product":"xorg-x11-server"},{"vendor":"x.org","product":"x_server"},{"vendor":"x.org","product":"xorg-x11-server"},{"vendor":"x.org","product":"xwayland"}],"references":[{"url":"https://gitlab.freedesktop.org/xorg/xserver/-/commit/2779affbdb4354e894f490e56f962527d6125043","tags":["patch","Patch","fix"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/08/2","tags":["vendor-advisory","Mailing List","Patch","Third Party Advisory","advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56000","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-4gcc-rqqq-58jp"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-56000","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:38489","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-55999","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56000","tags":["report"]},{"url":"https://bugzilla.redhat.com/2496165","tags":["report"]},{"url":"https://bugzilla.redhat.com/2496193","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-38489.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:38490","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-38490.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-56000","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1784219693.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55999","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56000.json","tags":["advisory"]},{"url":"https://gitlab.freedesktop.org/xorg/xserver/","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-56000","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0303.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35860","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496165","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496193","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_38489.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55999","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56000","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_38490.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50100","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50100.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50718","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50718.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:52398","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_52398.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:38489","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:38490","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622617-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268893","tags":["report"]},{"url":"https://bugzilla.suse.com/1268894","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56000","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262786-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262787-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262788-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262789-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262791-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-56000","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-56000","title":"xorg-x11-server / xwayland GLX contextTags Use-After-Free in CommonMakeCurrent()","description":"Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a Heap Use After Free, due to CommonMakeCurrent() pointing into potentially reallocated memory.","status":"published","published":"2026-07-08T07:36:15.357Z","modified":"2026-07-08T12:42:16.061Z","cvss":[{"version":"4.0","score":9,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T13:36:51.6229Z"}],"euvd":[{"id":"EUVD-2026-42202","description":"Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a Heap Use After Free, due to CommonMakeCurrent() pointing into potentially reallocated memory.","status":"published","published":"2026-07-08T07:36:15Z","modified":"2026-07-08T12:42:16Z","cvss":[{"version":"4.0","score":9,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"updated_at":"2026-11-02T18:20:11.058935Z"}],"ghsa":[{"id":"GHSA-4gcc-rqqq-58jp","title":"Local attackers with a X connection able to provide GLX commit to the X server xorg-server before...","description":"Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a Heap Use After Free, due to CommonMakeCurrent() pointing into potentially reallocated memory.","status":"published","published":"2026-07-08T09:31:49Z","modified":"2026-07-09T21:31:16Z","cvss":[{"version":"4.0","score":9,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:09:22.189239Z"}],"nvd":[{"id":"CVE-2026-56000","description":"Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a Heap Use After Free, due to CommonMakeCurrent() pointing into potentially reallocated memory.","status":"published","published":"2026-07-08T09:16:29.923Z","modified":"2026-07-09T19:47:29.21Z","cvss":[{"version":"4.0","score":9,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:12:28.040501Z"}],"osv":[{"id":"ALPINE-CVE-2026-56000","description":"Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a Heap Use After Free, due to CommonMakeCurrent() pointing into potentially reallocated memory.","status":"published","published":"2026-07-08T09:16:29.923Z","modified":"2026-11-03T06:33:05.797411067Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:15:37.282377Z"},{"id":"BELL-CVE-2026-56000","status":"published","published":"2026-07-08T20:20:43.721312Z","modified":"2026-07-16T07:15:10.878627028Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:24.657778Z"},{"id":"CVE-2026-56000","title":"xorg-x11-server / xwayland GLX contextTags Use-After-Free in CommonMakeCurrent()","description":"Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a Heap Use After Free, due to CommonMakeCurrent() pointing into potentially reallocated memory.","status":"published","published":"2026-07-08T07:36:15.357Z","modified":"2026-10-28T11:17:51.115743393Z","cvss":[{"version":"4.0","score":9,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:45:11.609219Z"},{"id":"DEBIAN-CVE-2026-56000","description":"Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a Heap Use After Free, due to CommonMakeCurrent() pointing into potentially reallocated memory.","status":"published","published":"2026-07-08T09:16:29.923Z","modified":"2026-10-01T03:03:26.991065335Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:57.590991Z"},{"id":"RHSA-2026:38489","title":"Red Hat Security Advisory: xorg-x11-server-Xwayland security update","status":"published","published":"2026-07-13T10:07:39Z","modified":"2026-08-12T10:13:29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:38490","title":"Red Hat Security Advisory: xorg-x11-server-Xwayland security update","status":"published","published":"2026-07-14T10:08:58Z","modified":"2026-08-12T10:13:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:50100","title":"Red Hat Security Advisory: xorg-x11-server-Xwayland security update","status":"published","published":"2026-08-05T10:37:27Z","modified":"2026-08-12T10:15:45Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:50718","title":"Red Hat Security Advisory: xorg-x11-server-Xwayland security update","status":"published","published":"2026-08-05T10:37:44Z","modified":"2026-08-12T10:15:54Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:52398","title":"Red Hat Security Advisory: xorg-x11-server-Xwayland security update","status":"published","published":"2026-08-10T10:13:34Z","modified":"2026-08-12T10:16:12Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RLSA-2026:38489","title":"Important: xorg-x11-server-Xwayland security update","description":"Xwayland is an X server for running X clients under Wayland.\n\nSecurity Fix(es):\n\n* xorg: X11: xserver: X.org: glamor Font Atlas Heap Buffer Overflow (CVE-2026-55999)\n\n* X.org: xorg-x11-server: GLX contextTags Use-After-Free in CommonMakeCurrent() (CVE-2026-56000)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-07-14T12:05:31.426386Z","modified":"2026-07-14T12:30:06.158310939Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:38490","title":"Important: xorg-x11-server-Xwayland security update","description":"Xwayland is an X server for running X clients under Wayland.\n\nSecurity Fix(es):\n\n* xorg: X11: xserver: X.org: glamor Font Atlas Heap Buffer Overflow (CVE-2026-55999)\n\n* X.org: xorg-x11-server: GLX contextTags Use-After-Free in CommonMakeCurrent() (CVE-2026-56000)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-07-14T12:03:23.695448Z","modified":"2026-07-14T12:30:04.876619853Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"UBUNTU-CVE-2026-56000","description":"Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a Heap Use After Free, due to CommonMakeCurrent() pointing into potentially reallocated memory.","status":"published","published":"2026-07-08T09:16:00Z","modified":"2026-10-19T23:30:07.996301195Z","cvss":[{"version":"4.0","score":9,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"ALSA-2026:38489","title":"Important: xorg-x11-server-Xwayland security update","description":"Xwayland is an X server for running X clients under Wayland.  \n\nSecurity Fix(es):  \n\n  * xorg: X11: xserver: X.org: glamor Font Atlas Heap Buffer Overflow (CVE-2026-55999)\n  * X.org: xorg-x11-server: GLX contextTags Use-After-Free in CommonMakeCurrent() (CVE-2026-56000)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-13T00:00:00Z","modified":"2026-10-29T11:30:27.120063507Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:38490","title":"Important: xorg-x11-server-Xwayland security update","description":"Xwayland is an X server for running X clients under Wayland.  \n\nSecurity Fix(es):  \n\n  * xorg: X11: xserver: X.org: glamor Font Atlas Heap Buffer Overflow (CVE-2026-55999)\n  * X.org: xorg-x11-server: GLX contextTags Use-After-Free in CommonMakeCurrent() (CVE-2026-56000)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-13T00:00:00Z","modified":"2026-10-29T11:32:35.687673976Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"AZL-92072","title":"CVE-2026-56000 affecting package xorg-x11-server 1.20.10-6","description":"Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a Heap Use After Free, due to CommonMakeCurrent() pointing into potentially reallocated memory.","status":"published","published":"2026-07-08T09:16:29Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:25.633663Z"},{"id":"AZL-92265","title":"CVE-2026-56000 affecting package xorg-x11-server-Xwayland for versions less than 24.1.13-1","description":"Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a Heap Use After Free, due to CommonMakeCurrent() pointing into potentially reallocated memory.","status":"published","published":"2026-07-08T09:16:29Z","modified":"2026-08-28T17:56:43.925764Z","updated_at":"2026-11-02T15:28:11.723718Z"},{"id":"CLSA-2026-1784219693","title":"xorg-x11-server-Xwayland: Fix of 2 CVEs","description":"- CVE fix for: CVE-2026-55999, CVE-2026-56000","status":"published","published":"2026-07-16T16:35:23Z","modified":"2026-10-26T09:31:17.053218905Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"MGASA-2026-0303","title":"Updated x11-server x11-server-xwayland tigervnc packages fix security vulnerabilities","description":"The updated packages fix security vulnerabilities:\nglamor Font Atlas Heap Buffer Overflow. (CVE-2026-55999)\nGLX contextTags Use-After-Free in CommonMakeCurrent(). (CVE-2026-56000)\n","status":"published","published":"2026-07-27T22:45:13Z","modified":"2026-07-27T23:00:05.858129079Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11227-1","title":"xwayland-24.1.12-1.1 on GA media","description":"These are all security issues fixed in the xwayland-24.1.12-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-08T00:00:00Z","modified":"2026-07-09T10:00:08.928642333Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:11244-1","title":"xorg-x11-server-21.1.21-8.1 on GA media","description":"These are all security issues fixed in the xorg-x11-server-21.1.21-8.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-09T00:00:00Z","modified":"2026-07-10T10:00:09.187608878Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21273-1","title":"Security update for xorg-x11-server","description":"This update for xorg-x11-server fixes the following issues\n\n- CVE-2026-55999: missing bounds check in `glamor_font_get` can lead to a heap buffer overflow when a font loaded from\n  a malicious PCF file is processed (bsc#1268893).\n- CVE-2026-56000: improper memory management in `CommonMakeCurrent` can lead to a heap use-after-free when an\n  interaction with a malicious client creating GLX contexts happens (bsc#1268894).\n","status":"published","published":"2026-07-08T17:58:06Z","modified":"2026-07-11T18:24:35.176721007Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21283-1","title":"Security update for xwayland","description":"This update for xwayland fixes the following issues\n\n- CVE-2026-55999: missing bounds check in `glamor_font_get` can lead to a heap buffer overflow when a font loaded from\n  a malicious PCF file is processed (bsc#1268893).\n- CVE-2026-56000: improper memory management in `CommonMakeCurrent` can lead to a heap use-after-free when an\n  interaction with a malicious client creating GLX contexts happens (bsc#1268894).\n  ","status":"published","published":"2026-07-10T08:45:38Z","modified":"2026-07-13T18:24:55.679454905Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-56000","title":"CVE-2026-56000 in xorg-server - Patched by Root","description":"Root has patched CVE-2026-56000 in the xorg-server package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-10-09T10:36:01Z","modified":"2026-10-09T11:15:02.553668729Z","updated_at":"2026-11-02T15:53:30.44348Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-56000","title":"CVE-2026-56000 in xorg-server - Patched by Root","description":"Root has patched CVE-2026-56000 in the xorg-server package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-09-09T10:31:43Z","modified":"2026-09-09T11:15:04.166854365Z","updated_at":"2026-11-02T15:53:32.298225Z"},{"id":"SUSE-SU-2026:22617-1","title":"Security update for xwayland","description":"This update for xwayland fixes the following issues\n\n- CVE-2026-55999: missing bounds check in `glamor_font_get` can lead to a heap buffer overflow when a font loaded from\n  a malicious PCF file is processed (bsc#1268893).\n- CVE-2026-56000: improper memory management in `CommonMakeCurrent` can lead to a heap use-after-free when an\n  interaction with a malicious client creating GLX contexts happens (bsc#1268894).\n  ","status":"published","published":"2026-07-10T08:44:49Z","modified":"2026-07-17T18:24:02.38272204Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:2786-1","title":"Security update for xorg-x11-server","description":"This update for xorg-x11-server fixes the following issues\n\n- CVE-2026-55999: missing bounds check in `glamor_font_get` can lead to a heap buffer overflow when a font loaded from\n  a malicious PCF file is processed (bsc#1268893).\n- CVE-2026-56000: improper memory management in `CommonMakeCurrent` can lead to a heap use-after-free when an\n  interaction with a malicious client creating GLX contexts happens (bsc#1268894).\n","status":"published","published":"2026-07-08T07:16:50Z","modified":"2026-07-09T10:00:06.022696381Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:2787-1","title":"Security update for xwayland","description":"This update for xwayland fixes the following issues\n\n- CVE-2026-55999: glamor Font Atlas Heap Buffer Overflow (bsc#1268893).\n- CVE-2026-56000: GLX contextTags Use-After-Free in CommonMakeCurrent() (bsc#1268894).\n","status":"published","published":"2026-07-08T07:19:18Z","modified":"2026-07-09T10:00:06.12234968Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:2788-1","title":"Security update for xorg-x11-server","description":"This update for xorg-x11-server fixes the following issues\n\n- CVE-2026-55999: missing bounds check in `glamor_font_get` can lead to a heap buffer overflow when a font loaded from\n  a malicious PCF file is processed (bsc#1268893).\n- CVE-2026-56000: improper memory management in `CommonMakeCurrent` can lead to a heap use-after-free when an\n  interaction with a malicious client creating GLX contexts happens (bsc#1268894).\n","status":"published","published":"2026-07-08T07:22:14Z","modified":"2026-07-09T10:00:06.162548539Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:2789-1","title":"Security update for xorg-x11-server","description":"This update for xorg-x11-server fixes the following issues\n\n- CVE-2026-55999: glamor Font Atlas Heap Buffer Overflow (bsc#1268893).\n- CVE-2026-56000: GLX contextTags Use-After-Free in CommonMakeCurrent() (bsc#1268894).\n","status":"published","published":"2026-07-08T07:29:05Z","modified":"2026-07-09T10:00:06.17085591Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:2791-1","title":"Security update for xorg-x11-server","description":"This update for xorg-x11-server fixes the following issues\n\n- CVE-2026-55999: glamor Font Atlas Heap Buffer Overflow (bsc#1268893).\n- CVE-2026-56000: GLX contextTags Use-After-Free in CommonMakeCurrent() (bsc#1268894).\n","status":"published","published":"2026-07-08T07:33:13Z","modified":"2026-07-09T10:00:06.123663618Z","updated_at":"2026-11-02T15:54:04.987808Z"}]}}