CVE-2026-50256

Name of the Vulnerable Software and Affected Versions X.Org X server (affected versions not specified) Xwayland (affected versions not specified) rootio-xorg-server versions prior to the fixed versions for Root:Debian:11

Description A stack-based buffer overflow occurs in the X.Org X server and Xwayland due to a mismatch between the server and the libXfont2 library regarding the maximum font name length. During font alias resolution, the server allocates a 256 byte stack buffer, while libXfont2 allows an alias target name length of up to 1024 bytes. A font alias name between 257 and 1023 bytes can be copied into the undersized buffer without validation. This can lead to a server crash or privilege escalation if the X server is running with root privileges.

Recommendations Update rootio-xorg-server to the latest fixed version for Root:Debian:11. At the moment, there is no information about a newer version that contains a fix for X.Org X server and Xwayland.