CVE-2026-50258
HIGH severity · CVSS 7.8 · CWE-121
7.8CVSS HIGH
Summary
A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. The X server has multiple stack buffers sized XkbMaxShiftLevel * XkbNumKbdGroups but CheckKeyTypes() does not verify or clamp non-canonical key types to XkbMaxShiftLevel. A client can change key types to excessive shift levels and trigger stack overflows. This is caused by an incomplete fix of CVE-2025-26597. This may be used to crash the server, or for privilege escalation if the X server runs as root.
Impact & exploitability
Attack vectorLocal
Attack complexityLow
Privileges requiredLow
User interactionNone
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
Exploit probability (EPSS)0%
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products we track (1)
Recommendation
Apply the vendor fix promptly. Open any affected product above for its exact safe version.
Additional information
- NVD record
- https://access.redhat.com/errata/RHSA-2026:26562
- https://access.redhat.com/errata/RHSA-2026:26566
- https://access.redhat.com/errata/RHSA-2026:26590
- https://access.redhat.com/errata/RHSA-2026:26610
- https://access.redhat.com/errata/RHSA-2026:26709
- https://access.redhat.com/errata/RHSA-2026:28923
- https://access.redhat.com/errata/RHSA-2026:29844
- https://access.redhat.com/errata/RHSA-2026:36083