CVE-2026-50258: Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb key types due to unchecked shift levels
A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. The X server has multiple stack buffers sized XkbMaxShiftLevel * XkbNumKbdGroups but CheckKeyTypes() does not verify or clamp non-canonical key types to XkbMaxShiftLevel. A client can change key types to excessive shift levels and trigger stack overflows. This is caused by an incomplete fix of CVE-2025-26597. This may be used to crash the server, or for privilege escalation if the X server runs as root.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50258?
CVE-2026-50258 has a high severity rating of 7.8.
How do I fix CVE-2026-50258?
To mitigate CVE-2026-50258, update to the latest patched version of the X.Org X server or Xwayland.
What type of vulnerability is CVE-2026-50258?
CVE-2026-50258 is classified as a stack buffer overflow vulnerability.
Which software is affected by CVE-2026-50258?
CVE-2026-50258 affects the X.Org X Server and X.Org Xwayland.
What are the potential impacts of CVE-2026-50258?
CVE-2026-50258 could allow an attacker to execute arbitrary code due to unchecked shift levels.