RHSA-2026:26709: Security update for 8 packages

RHSA-2026:26709, released June 24, 2026, fixes 9 CVEs across 8 products. None of them is reported as exploited. Patch Radar priority: High.

High

CVEs closed

None rated Critical

Exploited

None reported

Highest CVSS

7.8

Base score, 0 to 10

Highest EPSS

0.0017

5th percentile

Priority of the 9 CVEs

Patch now 0
                                Urgent 0
                                High 9
                                Routine 0

Fixed package versions

Product	Release	Fixed in
xorg-x11-server-Xdmx	RHEL 8	0:1.20.11-28.el8_10.2
xorg-x11-server-Xephyr	RHEL 8	0:1.20.11-28.el8_10.2
xorg-x11-server-Xnest	RHEL 8	0:1.20.11-28.el8_10.2
xorg-x11-server-Xorg	RHEL 8	0:1.20.11-28.el8_10.2
xorg-x11-server-Xvfb	RHEL 8	0:1.20.11-28.el8_10.2
xorg-x11-server-common	RHEL 8	0:1.20.11-28.el8_10.2
xorg-x11-server-devel	RHEL 8	0:1.20.11-28.el8_10.2
xorg-x11-server-source	RHEL 8	0:1.20.11-28.el8_10.2

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
High	CVE-2026-50259	Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb setmap request via mapwidths indexing	7.8	0.0017	None reported
High	CVE-2026-50258	Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb key types due to unchecked shift levels	7.8	0.0016	None reported
High	CVE-2026-50256	Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libxfont2 name length mismatch	7.8	0.0016	None reported
High	CVE-2026-50260	Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in freecounter()	7.8	0.0015	None reported
High	CVE-2026-50261	Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in syncchangecounter()	7.8	0.0015	None reported
High	CVE-2026-50264	xorg-server: An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat	7.8	0.0015	None reported
High	CVE-2026-50257	Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in misyncdestroyfence()	7.8	0.0014	None reported
High	CVE-2026-50263	Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free information disclosure in createsaverwindow()	7.8	0.0014	None reported
High	CVE-2026-50262	Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: out-of-bounds read/write in glx changedrawableattributes	7.8	0.0013	None reported

Also fixes CVE-2026-50259

ELSA-2026-26566
xorg-x11-server-Xwayland, xorg-x11-server-Xwayland-devel on ol 10
RHSA-2026:29844
tigervnc, tigervnc-icons, tigervnc-license and 4 more on RHEL 9
RLSA-2026:29844
tigervnc on rocky 9
RHSA-2026:28923
tigervnc, tigervnc-icons, tigervnc-license and 4 more on RHEL 8
RLSA-2026:28923
tigervnc on rocky 8
ALSA-2026:29844
tigervnc, tigervnc-icons, tigervnc-license and 4 more on almalinux 9
ELSA-2026-29844
tigervnc, tigervnc-icons, tigervnc-license and 4 more on ol 9
RHSA-2026:26590
xorg-x11-server-Xwayland, xorg-x11-server-Xwayland-devel on RHEL 9

Vendor advisory

https://access.redhat.com/errata/RHSA-2026:26709

For tools and AI agents

This page as data: JSON · Markdown

Link to this page

If this page saved you time, a link to it in your ticket, advisory or write-up helps others find it.

HTML

<a href="https://patchblox.com/security/fix/linux/rhsa-2026-26709">RHSA-2026:26709 on Patchblox Patch Radar</a>

Reusing the data? How to credit Patch Radar.

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.