This vulnerability involves an out-of-bounds read and write in the GLX ChangeDrawableAttributes function within the X.Org X server and Xwayland. The root cause is a faulty size validation check that permits reading a client-controlled number of bytes beyond the allocated request buffer, potentially exposing sensitive information. The write path requires byte-swapped clients, which are not enabled by default, reducing the likelihood of exploitation. Red Hat has issued security advisories RHSA-2026:26562 and RHSA-2026:26566 providing patches for affected versions of Red Hat Enterprise Linux 8 and 10. These advisories also address multiple other security issues in the same components.

Successful exploitation of this vulnerability can lead to information disclosure due to out-of-bounds reads. The CVSS v3.1 base score is 5.5 (medium severity), reflecting the local attack vector with low complexity and no user interaction required. Integrity and availability are not impacted. There are no known exploits in the wild at the time of the advisory.

Red Hat has released official security updates that fix this vulnerability in xorg-x11-server and xorg-x11-server-Xwayland packages for Red Hat Enterprise Linux 8 and 10. Users should apply the updates as described in Red Hat advisories RHSA-2026:26562 and RHSA-2026:26566. The vendor advisory provides detailed instructions for patching affected systems. No additional mitigations are required beyond applying the official patches.