CVE-2026-50256

A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library's maximum font name length can cause a stack buffer overflow during font alias resolution. The server allocates a 256 byte stack buffer but libXfont2's alias target name length is 1024 bytes. A font alias name between 257 and 1023 bytes causes the X server to copy that name into the undersized stack buffer without further checks. This may be used to crash the server, or for privilege escalation if the X server runs as root.

Red Hat rates this issue as Important impact. In xorg-x11-server and xorg-x11-server-Xwayland, the X server allocates a 256-byte stack buffer for font alias resolution but libXfont2 permits alias target names up to 1024 bytes. A local X client requesting a font alias between 257 and 1023 bytes triggers a stack buffer overflow. Any local user who can connect to the X server display can attempt exploitation. This may crash the display server or, where the X server runs with elevated privileges, could contribute to local privilege escalation. Upstream fixed this in xorg-server 21.1.23 and xwayland 24.1.12.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.