CVE-2026-50256

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libxfont2 name length mismatch

View on CVE.org
Published Jun 5, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Description
A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library's maximum font name length can cause a stack buffer overflow during font alias resolution. The server allocates a 256 byte stack buffer but libXfont2's alias target name length is 1024 bytes. A font alias name between 257 and 1023 bytes causes the X server to copy that name into the undersized stack buffer without further checks. This may be used to crash the server, or for privilege escalation if the X server runs as root.

Analysis

AI-generated

Technical impact

A stack-based buffer overflow exists in the X.Org X server and Xwayland, caused by a length mismatch between the X server's internal font buffer and libXfont2 alias target names. When an alias name between 257 and 1023 bytes is processed, the X server copies the name into a 256‑byte stack buffer without bounds checking. This flaw can crash the server or, if the server runs with elevated privileges, allow an attacker to elevate privileges or execute arbitrary code. The weakness is a classic CWE‑121 buffer overflow.

Affected Systems

Red Hat Enterprise Linux versions 6 through 10 are impacted. The flaw exists in the Xorg‑x11‑server package and its Xwayland integration, regardless of the specific minor release of RHEL, and can affect both desktop and server environments that use the default X.Org stack.

Risk and Exploitability

The CVSS score of 7.8 indicates a high severity. EPSS data is unavailable, but the lack of a KEV listing suggests no widespread exploit has been observed yet. The likely attack vector is local or remote font injection via the X server's configuration or file system, requiring the attacker to supply a malicious font alias between 257 and 1023 bytes. If the X server is running as root (e.g., on a login session), the overflow can lead to privilege escalation. An attacker could craft a malicious font package or alter system font configuration to trigger the overflow.

Remediation

Vendor Workaround

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

OpenCVE Recommended Actions

  • Install the latest Red Hat update that addresses CVE‑2026‑50256 in the X.Org X server package.
  • Ensure that the libXfont2 library installed on the system matches the X server’s expected alias name length, typically by upgrading to the newest matching release or applying any vendor-supplied consistency patches.
  • If Xwayland is not required, disable or uninstall it to reduce the attack surface; otherwise, restrict font alias names to 256 bytes or shorter by adjusting font configuration files or removing suspect font packages.

Generated by OpenCVE AI on June 5, 2026 at 12:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4737-1 xorg-server security update
Debian DLA Debian DLA DLA-4738-1 xorg-server security update
Debian DSA Debian DSA DSA-6370-1 xorg-server security update
References
Link Providers
https://access.redhat.com/errata/RHSA-2026:26562 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:26566 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:26590 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:26610 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:26709 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:28923 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:29844 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:36083 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:36085 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:36086 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:36087 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:36632 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:36633 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:36634 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:36768 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:36791 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:36792 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:36798 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:38502 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:38810 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:46377 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:46382 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:46385 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:46392 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:46456 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:46460 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:46473 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:49519 cve-icon cve-icon
https://access.redhat.com/security/cve/CVE-2026-50256 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2485380 cve-icon cve-icon
https://gitlab.freedesktop.org/xorg/xserver/-/commit/bb5158f962dc935e58ef8b4b5fcb31be201a6e07 cve-icon cve-icon cve-icon
https://lists.x.org/archives/xorg-announce/2026-June/003702.html cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-50256 cve-icon
https://redhat.atlassian.net/browse/PSIRTSUPT-16950 cve-icon cve-icon cve-icon
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50256.json cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-50256 cve-icon
History
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:6
Type Values Removed Values Added
CPEs cpe:/o:redhat:rhel_els:6
References
Type Values Removed Values Added
References
Type Values Removed Values Added
References
Type Values Removed Values Added
References
Type Values Removed Values Added
References
Type Values Removed Values Added
First Time appeared Redhat enterprise Linux Eus
Redhat rhel Tus
CPEs cpe:/a:redhat:rhel_e4s:8.8::appstream
cpe:/a:redhat:rhel_tus:8.8::appstream
cpe:/o:redhat:enterprise_linux_eus:10.0
Vendors & Products Redhat enterprise Linux Eus
Redhat rhel Tus
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:rhel_aus:8.4::appstream
cpe:/a:redhat:rhel_eus_long_life:8.4::appstream
References
Type Values Removed Values Added
First Time appeared Redhat rhel Aus
Redhat rhel Eus Long Life
CPEs cpe:/a:redhat:rhel_aus:8.6::appstream
cpe:/a:redhat:rhel_eus_long_life:8.6::appstream
Vendors & Products Redhat rhel Aus
Redhat rhel Eus Long Life
References
Type Values Removed Values Added
First Time appeared Redhat rhel Els
Redhat rhel Eus
CPEs cpe:/a:redhat:rhel_e4s:9.4::appstream
cpe:/a:redhat:rhel_eus:9.6::appstream
cpe:/a:redhat:rhel_eus:9.6::crb
cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat rhel Els
Redhat rhel Eus
References
Type Values Removed Values Added
First Time appeared Redhat rhel E4s
CPEs cpe:/a:redhat:rhel_e4s:9.2::appstream
Vendors & Products Redhat rhel E4s
References
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:9
References
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:8
References
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:10 cpe:/o:redhat:enterprise_linux:10.2
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:enterprise_linux:8::crb
cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/a:redhat:enterprise_linux:9::crb
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:enterprise_linux:8::appstream
References
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared X.org x Server
X.org xwayland
CPEs cpe:2.3:a:x.org:x_server:*:*:*:*:*:*:*:*
cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
Vendors & Products X.org x Server
X.org xwayland
Type Values Removed Values Added
First Time appeared X.org
X.org xorg-server
Vendors & Products X.org
X.org xorg-server
Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important
Type Values Removed Values Added
Description A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library's maximum font name length can cause a stack buffer overflow during font alias resolution. The server allocates a 256 byte stack buffer but libXfont2's alias target name length is 1024 bytes. A font alias name between 257 and 1023 bytes causes the X server to copy that name into the undersized stack buffer without further checks. This may be used to crash the server, or for privilege escalation if the X server runs as root.
Title Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libxfont2 name length mismatch
First Time appeared Redhat
Redhat enterprise Linux
Weaknesses CWE-121
CPEs cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}
Earlier changes (19)
Weaknesses
  • CWE-121

    Stack-based Buffer Overflow

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Nov 4, 2026, 10:43 PM
Reserved
Jun 4, 2026, 2:55 PM

View source JSON

Updated
Aug 5, 2026, 12:14 PM

JSON

Status
Modified
Published
Jun 5, 2026, 12:16 PM
Modified
Nov 4, 2026, 11:17 PM

View source JSON

Severity
Important
Public date
Jun 2, 2026, 12:00 AM

View source Bugzilla JSON

Updated
Jun 7, 2026, 11:17 AM

JSON