CVE-2026-50258: Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb key types due to unchecked shift levels
A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. The X server has multiple stack buffers sized XkbMaxShiftLevel XkbNumKbdGroups but CheckKeyTypes() does not verify or clamp non-canonical key types to XkbMaxShiftLevel. A client can change key types to excessive shift levels and trigger stack overflows. This is caused by an incomplete fix of CVE-2025-26597. This may be used to crash the server, or for privilege escalation if the X server runs as root.
Other sources
The X server has multiple stack buffers sized XkbMaxShiftLevel XkbNumKbdGroups but CheckKeyTypes() does not verify or clamp non-canonical key types to XkbMaxShiftLevel. A client can change key types to excessive shift levels and trigger three separate stack overflows.
This is caused by an incomplete fix of CVE-2025-26597.
Any X client that can connect to the server can trigger this issue. This may be used to crash the server, or for privilege escalation if the X server runs as root.
Components affected: xorg-x11-server, xorg-x11-server-Xwayland Versions affected: xorg-x11-server <= 21.1.22, xorg-x11-server-Xwayland <= 24.1.9
Fixed upstream in xorg-server-21.1.23 and xwayland-24.1.12. Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/543e108516428fc8c3bea91d6563ad266f9a801e
Reported via ZDI-CAN-30160 (Trend Micro Zero Day Initiative). Tracking: PSIRTSUPT-16950.
— Red Hat
Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb key types due to unchecked shift levels
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.1.12-1 - Upgrade
Upgrade
xorg-x11-serverto a version that resolves this vulnerability.Fixed in 21.1.23 - Upgrade
Upgrade
xorg-x11-server-Xwaylandto a version that resolves this vulnerability.Fixed in 24.1.12 - Compensating control
Because any X client that can connect to the X server can trigger the issue, restrict X server access (e.g., allow connections only from trusted clients/systems and block untrusted network access to the X server).
- Operational
If the X server was exposed prior to patching, restart/redeploy the X server and Xwayland services to ensure the vulnerable code paths are replaced (Tracking: PSIRTSUPT-16950; ZDI-CAN-30160).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50258?
CVE-2026-50258 has a high severity rating of 7.8.
How do I fix CVE-2026-50258?
To mitigate CVE-2026-50258, update to the latest patched version of the X.Org X server or Xwayland.
What type of vulnerability is CVE-2026-50258?
CVE-2026-50258 is classified as a stack buffer overflow vulnerability.
Which software is affected by CVE-2026-50258?
CVE-2026-50258 affects the X.Org X Server and X.Org Xwayland.
What are the potential impacts of CVE-2026-50258?
CVE-2026-50258 could allow an attacker to execute arbitrary code due to unchecked shift levels.