A use-after-free vulnerability (CVE-2026-50263) exists in the CreateSaverWindow() function of the X.Org X server and Xwayland on Red Hat Enterprise Linux 10. An attacker with local privileges can trigger a use-after-free read by changing window attributes and forcing the screen saver, which may lead to information disclosure. This issue is part of a set of security flaws fixed in the xorg-x11-server and xorg-x11-server-Xwayland packages. Red Hat has issued official security advisories (RHSA-2026:26566) providing patches that resolve this and other related vulnerabilities. The affected versions are Red Hat Enterprise Linux 10 from 10.0.0 up to but not including 10.2.2. The vulnerability has a CVSS v3.1 score of 5.5 (medium severity) with attack vector local, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.

Successful exploitation of this use-after-free vulnerability can lead to information disclosure on affected systems. The flaw allows a local attacker to read memory after it has been freed, potentially exposing sensitive information. There is no indication of integrity or availability impact. No known exploits are reported in the wild at this time.

Red Hat has released official security updates that fix this vulnerability in Red Hat Enterprise Linux 10 starting from version 10.2.2. Users should apply the latest available updates for the xorg-x11-server and xorg-x11-server-Xwayland packages as described in Red Hat Security Advisory RHSA-2026:26566. No additional mitigation steps are required beyond applying the official patches.