CVE-2026-56000 is a heap use-after-free vulnerability classified as CWE-416 affecting X.Org's xorg-x11-server and xwayland prior to versions 21.2.24 and 24.1.13. The vulnerability can be triggered by a local attacker who has an X connection able to provide GLX commit to the X server. The root cause is that the CommonMakeCurrent() function references memory that may have been reallocated, leading to use-after-free conditions. This flaw could potentially allow an attacker to cause a denial of service or execute arbitrary code. The CVSS 4.0 base score is 9, reflecting critical severity. Although patch availability is indicated as true, no official patch or remediation guidance has been confirmed or published at this time.

The vulnerability allows a local attacker with an X connection to trigger a use-after-free condition in the X.Org xorg-x11-server or xwayland, potentially leading to denial of service or arbitrary code execution. The high CVSS score of 9 reflects the critical nature of the flaw, with high impact on confidentiality, integrity, and availability. However, there are no known exploits in the wild currently.

Patch availability is indicated but no official patch or remediation guidance has been confirmed or published yet. Users should monitor vendor advisories for official fixes and apply them once available. Until then, limiting local access to the X server and restricting untrusted GLX commits may reduce exposure.