CVE-2026-50258

Name of the Vulnerable Software and Affected Versions X.Org X server (affected versions not specified) Xwayland (affected versions not specified)

Description A stack-based buffer overflow exists in the X.Org X server and Xwayland. The issue occurs because the CheckKeyTypes() function fails to verify or clamp non-canonical key types to XkbMaxShiftLevel, despite the server using multiple stack buffers sized XkbMaxShiftLevel * XkbNumKbdGroups. A client can trigger this overflow by changing key types to excessive shift levels. This flaw can lead to a server crash or privilege escalation if the X server is running with root privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.