This vulnerability is a use-after-free condition in the CreateSaverWindow() function of the X.Org X server and Xwayland on Red Hat Enterprise Linux 10. It allows a local client with low privileges to cause a use-after-free read by changing window attributes and forcing the screen saver, which can lead to information disclosure. The issue is part of a set of security fixes released by Red Hat addressing multiple stack buffer overflows, use-after-free bugs, and out-of-bounds memory accesses in xorg-x11-server and Xwayland components. The vendor advisory confirms that updated packages fixing this vulnerability are available for Red Hat Enterprise Linux 10 starting with version 10.2.2.

Successful exploitation of this use-after-free vulnerability can lead to information disclosure. The CVSS vector indicates local attack vector with low complexity and no user interaction required, and the impact is limited to confidentiality (high), with no integrity or availability impact. There are no known exploits in the wild at this time.

Red Hat has released official security updates that fix this vulnerability in xorg-x11-server and Xwayland packages for Red Hat Enterprise Linux 10. Systems running affected versions (>=10.0.0 <10.2.2) should be updated to version 10.2.2 or later to remediate this issue. Refer to Red Hat advisory RHSA-2026:26566 and the update instructions at https://access.redhat.com/articles/11258 for applying the patches. No additional mitigation is required once the update is applied.