Buffer overflow in X.org X Server
CVE-2026-50259
A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. _XkbSetMapChecks() declares a fixed-size stack buffer mapWidths[256] indexed by key type index. The helper function CheckKeyTypes() writes to this buffer at a client-controlled offset, allowing a stack buffer overflow. This may be used to crash the server, or for privilege escalation if the X server runs as root.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.002 (11.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 12th percentile — 11.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: +0.001
Affected products
- X.org X Server
- X.org Xwayland
- Red Hat Enterprise Linux 10 — versions 0:24.1.9-4.el10_2.2
- Red Hat Enterprise Linux 10.0 Extended Update Support — versions 0:24.1.5-6.el10_0.1
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 6 Extended Lifecycle Support - Extension — versions 0:1.1.0-25.el6_10.18
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 7 Extended Lifecycle Support — versions 0:1.8.0-36.el7_9.5, 0:1.20.4-35.el7_9
- Red Hat Enterprise Linux 8 — versions 0:21.1.3-20.el8_10.2, 0:1.20.11-28.el8_10.2, 0:1.15.0-10.el8_10
- Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support — versions 0:1.11.0-8.el8_4.16, 0:1.20.10-5.el8_4
Weakness classification (CWE)
References
- access.redhat.com/security/cve/CVE-2026-50259 (Third Party Advisory, vdb-entry)
- RHBZ#2485384 (issue-tracking, Third Party Advisory, Issue Tracking)
- gitlab.freedesktop.org/xorg/xserver/-/commit/867b59b33bee669cb412f1314e47c52eac… (Patch)
- lists.x.org/archives/xorg-announce/2026-June/003702.html (Mailing List, Third Party Advisory)
- redhat.atlassian.net/browse/PSIRTSUPT-16950 (Permissions Required)
- RHSA-2026:26562 (vendor-advisory)
- RHSA-2026:26590 (vendor-advisory)
- RHSA-2026:26610 (vendor-advisory)
- RHSA-2026:26709 (vendor-advisory)
- RHSA-2026:26566 (vendor-advisory)
Frequently asked questions
- What is CVE-2026-50259?
- CVE-2026-50259 is a high-severity vulnerability in X.org X Server, classified under Stack-based Buffer Overflow. CVSS score: 7.8/10. Published 2026-06-05.
- How severe is CVE-2026-50259?
- High severity. CVSS v3 base score is 7.8 out of 10.