CVE-2026-50259: Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb setmap request via mapwidths indexing
XkbSetMapChecks() declares a fixed-size stack buffer mapWidths[256] indexed by key type index. The helper function CheckKeyTypes() writes to this buffer at a client-controlled offset, allowing a stack buffer overflow.
Any X client that can connect to the server can trigger this issue. This may be used to crash the server, or for privilege escalation if the X server runs as root.
Components affected: xorg-x11-server, xorg-x11-server-Xwayland Versions affected: xorg-x11-server <= 21.1.22, xorg-x11-server-Xwayland <= 24.1.9
Fixed upstream in xorg-server-21.1.23 and xwayland-24.1.12. Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/867b59b33bee669cb412f1314e47c52eacf6e00b
Reported via ZDI-CAN-30161 (Trend Micro Zero Day Initiative). Tracking: PSIRTSUPT-16950.
Other sources
A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. XkbSetMapChecks() declares a fixed-size stack buffer mapWidths[256] indexed by key type index. The helper function CheckKeyTypes() writes to this buffer at a client-controlled offset, allowing a stack buffer overflow. This may be used to crash the server, or for privilege escalation if the X server runs as root.
— NVD
Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb setmap request via mapwidths indexing
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.1.12-1 - Upgrade
Upgrade
xorg-x11-serverto a version that resolves this vulnerability.Fixed in 21.1.23 - Upgrade
Upgrade
xorg-x11-server-Xwaylandto a version that resolves this vulnerability.Fixed in 24.1.12 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch ZDI-CAN-30161 - Compensating control
Ensure only trusted systems/users can connect to the X server (any X client that can connect can trigger the issue), e.g., restrict network access/ACLs/firewall rules to the X server and Xwayland.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50259?
The severity of CVE-2026-50259 is high with a score of 7.8.
How do I fix CVE-2026-50259?
To fix CVE-2026-50259, update to the latest version of the X.Org X server and Xwayland provided by your distribution.
What causes the vulnerability in CVE-2026-50259?
CVE-2026-50259 is caused by a stack-based buffer overflow due to client-controlled offset writes in the xkb setmap request.
What systems are affected by CVE-2026-50259?
CVE-2026-50259 affects the X.Org X server and Xwayland.
What type of security issue is CVE-2026-50259 categorized as?
CVE-2026-50259 is categorized as a buffer overflow vulnerability.