CVE-2026-50259: Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb setmap request via mapwidths indexing
_XkbSetMapChecks() declares a fixed-size stack buffer mapWidths[256] indexed by key type index. The helper function CheckKeyTypes() writes to this buffer at a client-controlled offset, allowing a stack buffer overflow. Any X client that can connect to the server can trigger this issue. This may be used to crash the server, or for privilege escalation if the X server runs as root. Components affected: xorg-x11-server, xorg-x11-server-Xwayland Versions affected: xorg-x11-server <= 21.1.22, xorg-x11-server-Xwayland <= 24.1.9 Fixed upstream in xorg-server-21.1.23 and xwayland-24.1.12. Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/867b59b33bee669cb412f1314e47c52eacf6e00b Reported via ZDI-CAN-30161 (Trend Micro Zero Day Initiative). Tracking: PSIRTSUPT-16950.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50259?
The severity of CVE-2026-50259 is high with a score of 7.8.
How do I fix CVE-2026-50259?
To fix CVE-2026-50259, update to the latest version of the X.Org X server and Xwayland provided by your distribution.
What causes the vulnerability in CVE-2026-50259?
CVE-2026-50259 is caused by a stack-based buffer overflow due to client-controlled offset writes in the xkb setmap request.
What systems are affected by CVE-2026-50259?
CVE-2026-50259 affects the X.Org X server and Xwayland.
What type of security issue is CVE-2026-50259 categorized as?
CVE-2026-50259 is categorized as a buffer overflow vulnerability.