CVE-2026-50258

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb key types due to unchecked shift levels

View on CVE.org
Published Jun 5, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Description
A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. The X server has multiple stack buffers sized XkbMaxShiftLevel * XkbNumKbdGroups but CheckKeyTypes() does not verify or clamp non-canonical key types to XkbMaxShiftLevel. A client can change key types to excessive shift levels and trigger stack overflows. This is caused by an incomplete fix of CVE-2025-26597. This may be used to crash the server, or for privilege escalation if the X server runs as root.

Analysis

AI-generated

Technical impact

A stack-based buffer overflow exists in the X.Org X server and Xwayland; the bug is triggered when a client changes key types to excessive shift levels, bypassing a check that limits the number of shift levels to XkbMaxShiftLevel. The overflow can crash the server or, if the X server runs as root, allow an attacker to execute arbitrary code and gain root privileges.

Affected Systems

Red Hat Enterprise Linux 6 through 10 are affected because the vulnerability resides in the X.Org X server component shipped with these distributions. Any system that runs the X server or Xwayland under these RHEL versions is potentially vulnerable.

Risk and Exploitability

The CVSS score is 7.8, indicating a high severity. EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker who can send malformed key type commands over the X protocol; this may be done locally or remotely if the X server exposes a network connection. If the X server is executed as root, the overflow can be leveraged for privilege escalation. The absence of an official workaround means patching is the only effective defense.

Remediation

Vendor Workaround

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

OpenCVE Recommended Actions

  • Apply the latest Red Hat Security Advisory patch that corrects the key‑type bounds check in the X server.
  • Ensure the X server is not run with root privileges; use a non‑root wrapper or a rootless X session if it must be accessed remotely.
  • Restrict untrusted client connections by configuring .xauthority files, using xhost or firewalls to limit DISPLAY access to trusted hosts.

Generated by OpenCVE AI on June 5, 2026 at 12:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4737-1 xorg-server security update
Debian DLA Debian DLA DLA-4738-1 xorg-server security update
Debian DSA Debian DSA DSA-6370-1 xorg-server security update
References
Link Providers
https://access.redhat.com/errata/RHSA-2026:26562 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:26566 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:26590 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:26610 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:26709 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:28923 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:29844 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:36083 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:36085 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:36086 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:36087 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:36632 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:36633 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:36634 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:36768 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:36791 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:36792 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:36798 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:38502 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:38810 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:46377 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:46382 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:46385 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:46392 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:46456 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:46460 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:46473 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:49519 cve-icon cve-icon
https://access.redhat.com/security/cve/CVE-2026-50258 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2485383 cve-icon cve-icon
https://gitlab.freedesktop.org/xorg/xserver/-/commit/543e108516428fc8c3bea91d6563ad266f9a801e cve-icon cve-icon cve-icon
https://lists.x.org/archives/xorg-announce/2026-June/003702.html cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-50258 cve-icon
https://redhat.atlassian.net/browse/PSIRTSUPT-16950 cve-icon cve-icon cve-icon
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50258.json cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-50258 cve-icon
History
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:6
Type Values Removed Values Added
CPEs cpe:/o:redhat:rhel_els:6
References
Type Values Removed Values Added
References
Type Values Removed Values Added
References
Type Values Removed Values Added
References
Type Values Removed Values Added
References
Type Values Removed Values Added
First Time appeared Redhat enterprise Linux Eus
Redhat rhel Tus
CPEs cpe:/a:redhat:rhel_e4s:8.8::appstream
cpe:/a:redhat:rhel_tus:8.8::appstream
cpe:/o:redhat:enterprise_linux_eus:10.0
Vendors & Products Redhat enterprise Linux Eus
Redhat rhel Tus
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:rhel_aus:8.4::appstream
cpe:/a:redhat:rhel_eus_long_life:8.4::appstream
References
Type Values Removed Values Added
First Time appeared Redhat rhel Aus
Redhat rhel Eus Long Life
CPEs cpe:/a:redhat:rhel_aus:8.6::appstream
cpe:/a:redhat:rhel_eus_long_life:8.6::appstream
Vendors & Products Redhat rhel Aus
Redhat rhel Eus Long Life
References
Type Values Removed Values Added
First Time appeared Redhat rhel Els
Redhat rhel Eus
CPEs cpe:/a:redhat:rhel_e4s:9.4::appstream
cpe:/a:redhat:rhel_eus:9.6::appstream
cpe:/a:redhat:rhel_eus:9.6::crb
cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat rhel Els
Redhat rhel Eus
References
Type Values Removed Values Added
First Time appeared Redhat rhel E4s
CPEs cpe:/a:redhat:rhel_e4s:9.2::appstream
Vendors & Products Redhat rhel E4s
References
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:9
References
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:8
References
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:10 cpe:/o:redhat:enterprise_linux:10.2
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:enterprise_linux:8::crb
cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/a:redhat:enterprise_linux:9::crb
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:enterprise_linux:8::appstream
References
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared X.org xwayland
CPEs cpe:2.3:a:x.org:x_server:*:*:*:*:*:*:*:*
cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
Vendors & Products X.org xwayland
Type Values Removed Values Added
First Time appeared X.org
X.org x Server
Vendors & Products X.org
X.org x Server
Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important
Type Values Removed Values Added
Description A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. The X server has multiple stack buffers sized XkbMaxShiftLevel * XkbNumKbdGroups but CheckKeyTypes() does not verify or clamp non-canonical key types to XkbMaxShiftLevel. A client can change key types to excessive shift levels and trigger stack overflows. This is caused by an incomplete fix of CVE-2025-26597. This may be used to crash the server, or for privilege escalation if the X server runs as root.
Title Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb key types due to unchecked shift levels
First Time appeared Redhat
Redhat enterprise Linux
Weaknesses CWE-121
CPEs cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}
Earlier changes (19)
Weaknesses
  • CWE-121

    Stack-based Buffer Overflow

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Nov 4, 2026, 10:43 PM
Reserved
Jun 4, 2026, 2:55 PM

View source JSON

Updated
Aug 5, 2026, 12:14 PM

JSON

Status
Modified
Published
Jun 5, 2026, 12:16 PM
Modified
Nov 4, 2026, 11:17 PM

View source JSON

Severity
Important
Public date
Jun 2, 2026, 12:00 AM

View source Bugzilla JSON

Updated
Jun 7, 2026, 11:17 AM

JSON