X.Org Server ProcDRI2GetBuffers overflow allows local privilege escalation
Original title: ZDI-26-901: X.Org Server ProcDRI2GetBuffers Heap-based Buffer Overflow Privilege Escalation Vulnerability
ZDI rates CVE-2026-50264 at 7.8; exploitation needs prior low-privileged code execution.
Zero Day Initiative published ZDI-26-901 for a heap-based buffer overflow in X.Org Server’s ProcDRI2GetBuffers function. Local attackers who already have low-privileged code execution can escalate privileges. ZDI assigned CVSS 7.8 and CVE-2026-50264. Affected versions and a fix are not stated.
- Advisory identifier is ZDI-26-901.
- The flaw is a heap-based buffer overflow in ProcDRI2GetBuffers.
- Low-privileged code execution is a prerequisite.
- ZDI assigned a CVSS rating of 7.8.
Impact: local privilege escalation
| Product | Affected |
|---|---|
| X.Org Server | — |
- CVEs
- CVE-2026-50264
- Vendors
- X.Org
- Products
- X.Org Server
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-50264 | An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat | 7.8 | <1% |
From the original article
This vulnerability allows local attackers to escalate privileges on affected installations of X. Org Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.