CVE-2026-50257
A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence(). A client that sets up multiple fence triggers ca
CVSS
7.8
High
EPSS
0.1%
p3
KEV
—
Exploit Today
1
0-100
Published: Jun 5, 2026 · Last modified: Aug 5, 2026 · CWE-416
0.1%EPSS · 30 days0.2%
2026-09-302026-10-27
A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence(). A client that sets up multiple fence triggers can trigger a use-after-free function pointer call. An attacker would connect to the X server to set up a fence and await that fence, then a second X connection destroys the fence, causing the use-after-free. This may be used to crash the server, or for privilege escalation if the X server runs as root.
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:26562
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:26566
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:26590
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:26610
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:26709
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:28923
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:29844
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:36083
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:36085
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:36086
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:36087
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:36632
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:36633
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:36634
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:36768
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:36791
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:36792
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:36798
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:38502
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:38810
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-935165.5 MED—
———A use-after-free caused by lack of lifecycle management when adding / removing XInput master devices in X.org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X Clients to crash the X server or potentially execute code in X server context.19hCVE-2026-93515——
———A use-after-free in present_clear_window_notifies() in the X.org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by malicious X clients to crash or potentially execute code in the X server context.19hCVE-2026-1183578.8 HIG—
——0Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)5hCVE-2026-1183568.8 HIG—
——0Use after free in WTF in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)5hCVE-2026-1183538.8 HIG—
——0Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)5hCVE-2026-1183508.8 HIG—
——0Use after free in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)5h