Junglewise Threat Intelligence

CVE-2026-50258: X.Org X server and Xwayland stack buffer overflow in XKB key types

CVE-2026-50258 · Severity: high · CVSS 7.8 · Published 2026-06-05

Vendors: X.Org.

Executive brief

A security vulnerability has been identified in the X.Org X server and Xwayland, components responsible for managing graphical displays on Linux and Unix-like systems. An attacker with local access to a system can exploit this flaw to crash the display server or potentially gain administrative (root) privileges. This could lead to a complete system takeover or a denial of service for all users on the affected machine.

Technical details

A stack-based buffer overflow exists in the X.Org X server and Xwayland due to insufficient validation in the CheckKeyTypes() function. While the server uses stack buffers sized for XkbMaxShiftLevel * XkbNumKbdGroups, it fails to clamp non-canonical key types to the XkbMaxShiftLevel limit. An authenticated local client can define excessive shift levels (up to 255) to trigger overflows in functions like XkbKeyTypesForCoreSymbols, which indexes into a 252-element stack buffer. This vulnerability is an incomplete fix for CVE-2025-26597. Successful exploitation can lead to a server crash or local privilege escalation if the X server is running with root privileges. The issue is fixed in xorg-server 21.1.23 and xwayland 24.1.12.

Affected products

  • X.Org X server <= 21.1.22
  • X.Org Xwayland <= 24.1.9

Timeline

  • 2026-04-20: other: Upstream fix authored
  • 2026-06-02: advisory: X.Org security advisory released
  • 2026-06-05: disclosed: CVE published and NVD entry created

References