CVE-2026-50256
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
A stack-based buffer overflow vulnerability was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library's maximum font name length causes a stack buffer overflow during font alias resolution. The server allocates a 256-byte stack buffer but libXfont2's alias target name length is 1024 bytes, allowing an attacker to write beyond the buffer.
Risk Assessment
An attacker can crash the X server or escalate privileges if the server runs as root. This vulnerability can be exploited locally to gain control over the system.
Recommendation
Immediately update X.Org X server and Xwayland packages to the patched version. In the meantime, restrict X server access to trusted users only.
Other vulnerabilities in X.Org X server
See all- CVE-2026-34002Medium
A flaw was found in the X.Org X server related to an out-of-bounds read affecting XKB modifier map handling. An attacker with access to the X11 server can exploit this by sending a malformed request, leading to reading beyond intended memory boundaries.
- CVE-2026-34000Medium
A flaw was found in the X.Org X server that allows for out-of-bounds memory read in XKB geometry processing. An attacker can exploit this vulnerability to read uninitialized memory or out-of-bounds memory, potentially leading to memory disclosure or server crashes.
- CVE-2017-10971High
In the X.Org X server before 2017-06-19, a user authenticated to an X Session could crash or execute code in the context of the X Server by exploiting a stack overflow in the endianness conversion of X Events.
- CVE-2026-50264High
An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat. A client requesting multiple DRI2BufferBackLeft attachments and one DRI2BufferFrontLeft can trigger an out-of-bounds heap write.
- CVE-2026-50263Medium
A use-after-free vulnerability was found in the X.Org X server and Xwayland in the CreateSaverWindow() function. A client can trigger a use-after-free read by changing window attributes and forcing the screen saver, leading to information disclosure.
- CVE-2026-50262Medium
An out-of-bounds read flaw was found in the X.Org X server and Xwayland in __glXDisp_ChangeDrawableAttributes(). A wrong size validation check can read a client-controlled number of bytes, exceeding the request buffer, leading to information disclosure. A write path also exists but requires byte-swapped clients which is disabled by default.
- CVE-2026-50261High
A use-after-free vulnerability was found in the X.Org X server and Xwayland in the SyncChangeCounter() function. A client setting up multiple SyncCounters can trigger this flaw by destroying those counters via a second client connection while they are being changed.
- CVE-2026-50260High
A use-after-free vulnerability was found in the X.Org X server and Xwayland in the FreeCounter() function. A client that sets up multiple SyncCounters and awaits on those triggers can trigger the flaw when destroying those counters via a second client connection.
- CVE-2026-50259High
A stack-based buffer overflow vulnerability was found in the X.Org X server and Xwayland. The _XkbSetMapChecks() function declares a fixed-size stack buffer mapWidths[256] indexed by key type, and the helper CheckKeyTypes() writes to it at a client-controlled offset, causing overflow.
- CVE-2026-50258High
A stack-based buffer overflow vulnerability was found in the X.Org X server and Xwayland. The CheckKeyTypes() function does not verify or clamp non-canonical key types to XkbMaxShiftLevel, allowing a client to set excessive shift levels and trigger stack overflows. This is caused by an incomplete fix of CVE-2025-26597.
Original NVD description (English source)
A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library's maximum font name length can cause a stack buffer overflow during font alias resolution. The server allocates a 256 byte stack buffer but libXfont2's alias target name length is 1024 bytes. A font alias name between 257 and 1023 bytes causes the X server to copy that name into the undersized stack buffer without further checks. This may be used to crash the server, or for privilege escalation if the X server runs as root.