CVE-2026-50258

HighCVSS 7.8

Published: 05/06/2026(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

6th percentile - higher than 6% of all known CVEs

Summary

A stack-based buffer overflow vulnerability was found in the X.Org X server and Xwayland. The CheckKeyTypes() function does not verify or clamp non-canonical key types to XkbMaxShiftLevel, allowing a client to set excessive shift levels and trigger stack overflows. This is caused by an incomplete fix for CVE-2025-26597.

Risk Assessment

An attacker can crash the X server or, if the server runs as root, escalate privileges, posing a serious security risk to the system.

Recommendation

Immediately update the X.Org X server and Xwayland packages to a version containing the complete fix for CVE-2026-50258. Until the update, restrict X server access to trusted users only.

Original NVD description (English source)

A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. The X server has multiple stack buffers sized XkbMaxShiftLevel * XkbNumKbdGroups but CheckKeyTypes() does not verify or clamp non-canonical key types to XkbMaxShiftLevel. A client can change key types to excessive shift levels and trigger stack overflows. This is caused by an incomplete fix of CVE-2025-26597. This may be used to crash the server, or for privilege escalation if the X server runs as root.