PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-50256 Red Hat CVE debrief

A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library's maximum font name length can cause a stack buffer overflow during font alias resolution. The server allocates a 256 byte stack buffer but libXfont2's alias target name length is 1024 bytes. A font alias name between 257 and 1023 bytes causes the X server to copy that name into the undersized stack buffer without further checks. This may be used to crash the server, or for privilege escalation if the X server runs as root.

Vendor
Red Hat
Product
Red Hat Enterprise Linux 10
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-05
Original CVE updated
2026-06-08
Advisory published
2026-06-05
Advisory updated
2026-06-08

Who should care

Users of X.Org X server and Xwayland should apply patches or mitigations to prevent potential crashes or privilege escalation.

Technical summary

The X.Org X server and Xwayland are vulnerable to a stack-based buffer overflow (CWE-121) due to a mismatch in font name length handling. The X server allocates a 256-byte stack buffer for font alias resolution, but libXfont2 allows alias target names up to 1024 bytes. A specially crafted font alias name between 257 and 1023 bytes can cause a buffer overflow.

Defensive priority

high

Recommended defensive actions

  • Apply patches or updates from vendors like Red Hat to address the vulnerability.
  • Restrict access to the X server to prevent potential exploitation.
  • Monitor for suspicious activity or anomalies in X server logs.

Evidence notes

The CVE-2026-50256 record was published on 2026-06-05T12:16:38.727Z and last modified on 2026-06-08T16:45:14.903Z. The vulnerability affects X.Org X server and Xwayland, with CVSS score of 7.8 and HIGH severity.

Official resources

CVE-2026-50256 was published on 2026-06-05T12:16:38.727Z.