CVE-2026-56000 xorg-x11-server / xwayland GLX contextTags Use-After-Free in CommonMakeCurrent()

Critical 9.0 Published 8 Jul 2026 Updated 8 Jul 2026

Local attackers with X connections can trigger a heap use-after-free in the X server, potentially leading to code execution or privilege escalation.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-56000?

CVE-2026-56000 is a critical use after free vulnerability in X.org X Server, published on 8 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a Heap Use After Free, due to CommonMakeCurrent() pointing into potentially reallocated memory.

Weakness: CWE-416

Which versions are affected by CVE-2026-56000?

It affects 2 products.

Products include X.org X Server, X.org Xwayland.

How do I fix CVE-2026-56000?

Apply the vendor's patch.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2026-56000 being exploited?

There is no known exploitation of CVE-2026-56000 in the wild and no public exploit code.

All X.org X Server vulnerabilities

Sources

Also known as AZL-92072, AZL-92265, BELL-CVE-2026-56000, DEBIAN-CVE-2026-56000, ECHO-173c-c9ca-77ce, GHSA-4gcc-rqqq-58jp and 4 more.