Junglewise Threat Intelligence

CVE-2026-50256: X.Org X server stack buffer overflow in font alias resolution

CVE-2026-50256 · Severity: high · CVSS 7.8 · Published 2026-06-05

Vendors: X.Org.

Executive brief

A security vulnerability has been identified in the X.Org X server and Xwayland, which are core components used to manage graphical displays on Linux and Unix-like systems. An attacker with local access to a system could exploit a mismatch in how font names are handled to crash the system or gain elevated administrative (root) privileges. This could lead to a total compromise of the affected machine or a disruption of services.

Technical details

A stack-based buffer overflow exists in the X.Org X server and Xwayland due to a size mismatch between the server and the libXfont2 library. While the server allocates a 256-byte stack buffer for font alias resolution, libXfont2 allows alias target names up to 1024 bytes. An attacker can trigger this by creating a malicious font directory with an oversized alias, adding it via SetFontPath, and calling ListFonts. This results in an out-of-bounds write that can lead to local privilege escalation if the X server is running with root privileges. The issue is fixed in xorg-server 21.1.23 and xwayland 24.1.12.

Affected products

  • X.Org X server <= 21.1.22
  • X.Org Xwayland <= 24.1.9

Timeline

  • 2026-04-29: patched: Upstream fix authored by Peter Hutterer
  • 2026-06-02: advisory: X.Org security advisory published
  • 2026-06-05: disclosed: CVE published to NVD dataset

References