An out-of-bounds write vulnerability (CWE-787) exists in the DRI2 DRIGetBuffers/DRIGetBuffersWithFormat functions of the X.Org X server and Xwayland on Red Hat Enterprise Linux 10. A specially crafted client request involving multiple DRI2BufferBackLeft attachments and one DRI2BufferFrontLeft can trigger a heap write beyond allocated bounds. This may cause the X server to crash or enable privilege escalation if the server runs as root. Red Hat has released security updates that fix this issue as part of a broader patch for multiple vulnerabilities in xorg-x11-server and Xwayland components. The affected versions are Red Hat Enterprise Linux 10 versions >=10 and <10.2.2. The vendor advisory confirms the availability of patches and recommends applying the updates promptly.

Successful exploitation can cause a denial of service by crashing the X server or potentially allow privilege escalation if the X server is running with root privileges. The vulnerability impacts confidentiality, integrity, and availability (CIA triad) as indicated by the CVSS vector (C:H/I:H/A:H). There are no known exploits in the wild at this time.

Red Hat has released official security updates that fix this vulnerability in xorg-x11-server and xorg-x11-server-Xwayland packages for Red Hat Enterprise Linux 10. Users should apply the updates as described in the Red Hat advisories RHSA-2026:26566 and RHSA-2026:26562. No additional mitigation steps are required beyond applying the vendor-provided patches.