A stack-based buffer overflow exists in the X.Org X server and Xwayland, caused by a length mismatch between the X server's internal font buffer and libXfont2 alias target names. When an alias name between 257 and 1023 bytes is processed, the X server copies the name into a 256‑byte stack buffer without bounds checking. This flaw can crash the server or, if the server runs with elevated privileges, allow an attacker to elevate privileges or execute arbitrary code. The weakness is a classic CWE‑121 buffer overflow.

Red Hat Enterprise Linux versions 6 through 10 are impacted. The flaw exists in the Xorg‑x11‑server package and its Xwayland integration, regardless of the specific minor release of RHEL, and can affect both desktop and server environments that use the default X.Org stack.

The CVSS score of 7.8 indicates a high severity. EPSS data is unavailable, but the lack of a KEV listing suggests no widespread exploit has been observed yet. The likely attack vector is local or remote font injection via the X server's configuration or file system, requiring the attacker to supply a malicious font alias between 257 and 1023 bytes. If the X server is running as root (e.g., on a login session), the overflow can lead to privilege escalation. An attacker could craft a malicious font package or alter system font configuration to trigger the overflow.