CVE-2026-50259

A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. _XkbSetMapChecks() declares a fixed-size stack buffer mapWidths[256] indexed by key type index. The helper function CheckKeyTypes() writes to this buffer at a client-controlled offset, allowing a stack buffer overflow. This may be used to crash the server, or for privilege escalation if the X server runs as root.

Red Hat rates this issue as Important impact. In xorg-x11-server and xorg-x11-server-Xwayland, _XkbSetMapChecks() uses a fixed 256-element stack buffer mapWidths[] indexed by a client-controlled key type index. CheckKeyTypes() writes beyond the buffer boundary, causing a stack buffer overflow. Any local user who can connect to the X server display can attempt exploitation. Upstream fixed this in xorg-server 21.1.23 and xwayland 24.1.12.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.