Log in Start free

Vulnerability · Published Jun 5, 2026 · Assigned by redhat

CVE-2026-50256Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libxfont2 name length mismatch

High 7.8

In plain English

A high-severity stack buffer overflow in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 95.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library's maximum font name length can cause a stack buffer overflow during font alias resolution. The server allocates a 256 byte stack buffer but libXfont2's alias target name length is 1024 bytes. A font alias name between 257 and 1023 bytes causes the X server to copy that name into the undersized stack buffer without further checks. This may be used to crash the server, or for privilege escalation if the X server runs as root.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8tigervnc1.15.0-10.el8_10ALSA-2026:28923
AlmaLinux:9tigervnc1.15.0-7.el9_8.2ALSA-2026:29844
AlmaLinux:8tigervnc-icons1.15.0-10.el8_10ALSA-2026:28923
AlmaLinux:9tigervnc-icons1.15.0-7.el9_8.2ALSA-2026:29844
AlmaLinux:8tigervnc-license1.15.0-10.el8_10ALSA-2026:28923
AlmaLinux:9tigervnc-license1.15.0-7.el9_8.2ALSA-2026:29844
AlmaLinux:8tigervnc-selinux1.15.0-10.el8_10ALSA-2026:28923
AlmaLinux:9tigervnc-selinux1.15.0-7.el9_8.2ALSA-2026:29844
AlmaLinux:8tigervnc-server1.15.0-10.el8_10ALSA-2026:28923
AlmaLinux:9tigervnc-server1.15.0-7.el9_8.2ALSA-2026:29844
AlmaLinux:8tigervnc-server-minimal1.15.0-10.el8_10ALSA-2026:28923
AlmaLinux:9tigervnc-server-minimal1.15.0-7.el9_8.2ALSA-2026:29844
AlmaLinux:8tigervnc-server-module1.15.0-10.el8_10ALSA-2026:28923
AlmaLinux:9tigervnc-server-module1.15.0-7.el9_8.2ALSA-2026:29844
AlmaLinux:8xorg-x11-server-Xdmx1.20.11-28.el8_10.2ALSA-2026:26709
AlmaLinux:9xorg-x11-server-Xdmx1.20.11-34.el9_8.2ALSA-2026:26610
AlmaLinux:8xorg-x11-server-Xephyr1.20.11-28.el8_10.2ALSA-2026:26709
AlmaLinux:9xorg-x11-server-Xephyr1.20.11-34.el9_8.2ALSA-2026:26610
AlmaLinux:8xorg-x11-server-Xnest1.20.11-28.el8_10.2ALSA-2026:26709
AlmaLinux:9xorg-x11-server-Xnest1.20.11-34.el9_8.2ALSA-2026:26610
AlmaLinux:8xorg-x11-server-Xorg1.20.11-28.el8_10.2ALSA-2026:26709
AlmaLinux:9xorg-x11-server-Xorg1.20.11-34.el9_8.2ALSA-2026:26610
AlmaLinux:8xorg-x11-server-Xvfb1.20.11-28.el8_10.2ALSA-2026:26709
AlmaLinux:9xorg-x11-server-Xvfb1.20.11-34.el9_8.2ALSA-2026:26610
AlmaLinux:10xorg-x11-server-Xwayland24.1.9-4.el10_2.2ALSA-2026:26566
AlmaLinux:8xorg-x11-server-Xwayland21.1.3-20.el8_10.2ALSA-2026:26562
AlmaLinux:9xorg-x11-server-Xwayland24.1.9-4.el9_8.2ALSA-2026:26590
AlmaLinux:10xorg-x11-server-Xwayland-devel24.1.9-4.el10_2.2ALSA-2026:26566
AlmaLinux:9xorg-x11-server-Xwayland-devel24.1.9-4.el9_8.2ALSA-2026:26590
AlmaLinux:8xorg-x11-server-common1.20.11-28.el8_10.2ALSA-2026:26709
AlmaLinux:9xorg-x11-server-common1.20.11-34.el9_8.2ALSA-2026:26610
AlmaLinux:8xorg-x11-server-devel1.20.11-28.el8_10.2ALSA-2026:26709
AlmaLinux:9xorg-x11-server-devel1.20.11-34.el9_8.2ALSA-2026:26610
AlmaLinux:8xorg-x11-server-source1.20.11-28.el8_10.2ALSA-2026:26709
AlmaLinux:9xorg-x11-server-source1.20.11-34.el9_8.2ALSA-2026:26610
Debian:12xorg-server2:21.1.7-3+deb12u13DEBIAN-CVE-2026-50256
Debian:13xorg-server2:21.1.16-1.3+deb13u3DEBIAN-CVE-2026-50256
Debian:14xorg-server2:21.1.23-1DEBIAN-CVE-2026-50256
Debian:12xwaylandno fix listedDEBIAN-CVE-2026-50256
Debian:13xwaylandno fix listedDEBIAN-CVE-2026-50256
Debian:14xwayland2:24.1.12-1DEBIAN-CVE-2026-50256
Rocky Linux:8tigervnc0:1.15.0-10.el8_10RLSA-2026:28923
Rocky Linux:9tigervnc0:1.15.0-7.el9_8.2RLSA-2026:29844
Rocky Linux:8xorg-x11-server0:1.20.11-28.el8_10.2RLSA-2026:26709
Rocky Linux:9xorg-x11-server0:1.20.11-34.el9_8.2RLSA-2026:26610
Rocky Linux:10xorg-x11-server-Xwayland0:24.1.9-4.el10_2.2RLSA-2026:26566
Rocky Linux:8xorg-x11-server-Xwayland0:21.1.3-20.el8_10.2RLSA-2026:26562
Rocky Linux:9xorg-x11-server-Xwayland0:24.1.9-4.el9_8.2RLSA-2026:26590
Ubuntu:22.04:LTSxorg-serverno fix listedUBUNTU-CVE-2026-50256
Ubuntu:24.04:LTSxorg-serverno fix listedUBUNTU-CVE-2026-50256
Ubuntu:25.10xorg-serverno fix listedUBUNTU-CVE-2026-50256
Ubuntu:26.04:LTSxorg-serverno fix listedUBUNTU-CVE-2026-50256
Ubuntu:26.10xorg-serverno fix listedUBUNTU-CVE-2026-50256
Ubuntu:22.04:LTSxwaylandno fix listedUBUNTU-CVE-2026-50256
Ubuntu:24.04:LTSxwaylandno fix listedUBUNTU-CVE-2026-50256
Ubuntu:25.10xwaylandno fix listedUBUNTU-CVE-2026-50256
Ubuntu:26.04:LTSxwaylandno fix listedUBUNTU-CVE-2026-50256
Ubuntu:26.10xwaylandno fix listedUBUNTU-CVE-2026-50256

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION see references
Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support see references
Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support see references
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support see references
Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On see references
Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On see references
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support see references
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support see references
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support see references
Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On see references
Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On see references
Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On see references
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service see references
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service see references
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service see references
Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions see references

Weakness: CWE-121 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References