This vulnerability involves an out-of-bounds read in the __glXDisp_ChangeDrawableAttributes() function of the X.Org X server and Xwayland, caused by incorrect size validation that permits reading a client-controlled number of bytes beyond the intended buffer. This can lead to information disclosure. Additionally, a write path exists but is less likely exploitable due to disabled byte-swapped clients by default. The issue affects Red Hat Enterprise Linux versions 8 (>=8 <8.10) and 10 (>=10 <10.2). Red Hat has issued security advisories RHSA-2026:26562 and RHSA-2026:26566 providing patches that fix this and multiple other related vulnerabilities in the xorg-x11-server and Xwayland components.

The vulnerability allows an attacker with local privileges to cause an out-of-bounds read, potentially leading to information disclosure. The CVSS v3.1 base score is 5.5 (medium severity) with the impact primarily on confidentiality. There is no impact on integrity or availability. Exploitation requires local access with low privileges and no user interaction. No known exploits are reported in the wild.

Red Hat has released official security updates for Red Hat Enterprise Linux 8 and 10 that address this vulnerability. Users should apply the xorg-x11-server and xorg-x11-server-Xwayland updates as detailed in Red Hat advisories RHSA-2026:26562 and RHSA-2026:26566. These updates fix CVE-2026-50262 along with other related vulnerabilities. Applying these patches fully mitigates the risk. No additional workarounds or mitigations are necessary.