CVE-2026-50259
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
A stack-based buffer overflow vulnerability was found in the X.Org X server and Xwayland. The _XkbSetMapChecks() function declares a fixed-size stack buffer mapWidths[256] indexed by key type, and the helper CheckKeyTypes() writes to it at a client-controlled offset, causing overflow.
Risk Assessment
An attacker can crash the X server or, if running as root, escalate privileges, posing a serious security risk to the system.
Recommendation
Immediately update the X.Org X server and Xwayland packages to a version containing the fix for this vulnerability.
Other vulnerabilities in X.Org X server
See all- CVE-2026-93516Medium
A use-after-free caused by lack of lifecycle management when adding or removing XInput master devices exists in X.org X Server before 21.1.25 and XWayland before 24.1.14. An authenticated X client could exploit this to crash the X server or potentially execute code in the X server context.
- CVE-2026-93515Medium
A use-after-free in present_clear_window_notifies() in X.org X Server before 21.1.25 and XWayland before 24.1.14 could be exploited by malicious X clients to crash the server or potentially execute code in the X server context.
- CVE-2017-10971High
In the X.Org X server before 2017-06-19, a user authenticated to an X Session could crash or execute code in the context of the X Server by exploiting a stack overflow in the endianness conversion of X Events.
- CVE-2026-93536Medium
A use-after-free caused by missing lifecycle management of gesture sprites in GestureBuildSprite() exists in X.Org X Server before 21.1.25 and XWayland before 24.1.14. An authenticated X client could exploit it to crash the X server or potentially execute code.
- CVE-2026-93524Medium
A buffer overread in CheckKeySyms() exists in X.Org X Server before 21.1.25 and XWayland before 24.1.14. An authenticated X client could exploit it to leak small amounts of information from X server memory or potentially crash the X server.
- CVE-2026-93523High
A heap buffer overflow in X.Org X Server before 21.1.15 and XWayland before 24.1.14 is triggered by an XIPassiveUngrabDevice request with an out-of-range modifier value. An authenticated X client could exploit this to crash the X server or potentially execute code in the server context.
- CVE-2026-93522High
A heap buffer overflow caused by mismatched size usage in the CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14. Authenticated X clients could use it to crash the server or potentially execute code in the X server context.
- CVE-2026-93521High
A buffer overflow in RandR ChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14. Authenticated X clients could use it to crash the server or execute code within the X server context.
- CVE-2026-93520High
A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange exists in X.org X server before 2.1.25 and XWayland before 24.1.14. Authenticated X clients could exploit it to crash or potentially execute code in the X server context.
- CVE-2026-93519High
A buffer overflow when handling pointer barriers in the XFIXES extension exists in X.Org X server before 21.1.25 and XWayland before 24.1.14. Authenticated X clients could exploit it to crash or potentially execute code in the X server context.
Original NVD description (English source)
A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. _XkbSetMapChecks() declares a fixed-size stack buffer mapWidths[256] indexed by key type index. The helper function CheckKeyTypes() writes to this buffer at a client-controlled offset, allowing a stack buffer overflow. This may be used to crash the server, or for privilege escalation if the X server runs as root.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS