Vulnerability · Published Jun 5, 2026 · Assigned by redhat

CVE-2026-50258Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb key types due to unchecked shift levels

High 7.8

In plain English

A high-severity stack buffer overflow in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.2%top 94.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. The X server has multiple stack buffers sized XkbMaxShiftLevel * XkbNumKbdGroups but CheckKeyTypes() does not verify or clamp non-canonical key types to XkbMaxShiftLevel. A client can change key types to excessive shift levels and trigger stack overflows. This is caused by an incomplete fix of CVE-2025-26597. This may be used to crash the server, or for privilege escalation if the X server runs as root.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	tigervnc	1.15.0-10.el8_10	ALSA-2026:28923
AlmaLinux:9	tigervnc	1.15.0-7.el9_8.2	ALSA-2026:29844
AlmaLinux:8	tigervnc-icons	1.15.0-10.el8_10	ALSA-2026:28923
AlmaLinux:9	tigervnc-icons	1.15.0-7.el9_8.2	ALSA-2026:29844
AlmaLinux:8	tigervnc-license	1.15.0-10.el8_10	ALSA-2026:28923
AlmaLinux:9	tigervnc-license	1.15.0-7.el9_8.2	ALSA-2026:29844
AlmaLinux:8	tigervnc-selinux	1.15.0-10.el8_10	ALSA-2026:28923
AlmaLinux:9	tigervnc-selinux	1.15.0-7.el9_8.2	ALSA-2026:29844
AlmaLinux:8	tigervnc-server	1.15.0-10.el8_10	ALSA-2026:28923
AlmaLinux:9	tigervnc-server	1.15.0-7.el9_8.2	ALSA-2026:29844
AlmaLinux:8	tigervnc-server-minimal	1.15.0-10.el8_10	ALSA-2026:28923
AlmaLinux:9	tigervnc-server-minimal	1.15.0-7.el9_8.2	ALSA-2026:29844
AlmaLinux:8	tigervnc-server-module	1.15.0-10.el8_10	ALSA-2026:28923
AlmaLinux:9	tigervnc-server-module	1.15.0-7.el9_8.2	ALSA-2026:29844
AlmaLinux:8	xorg-x11-server-Xdmx	1.20.11-28.el8_10.2	ALSA-2026:26709
AlmaLinux:9	xorg-x11-server-Xdmx	1.20.11-34.el9_8.2	ALSA-2026:26610
AlmaLinux:8	xorg-x11-server-Xephyr	1.20.11-28.el8_10.2	ALSA-2026:26709
AlmaLinux:9	xorg-x11-server-Xephyr	1.20.11-34.el9_8.2	ALSA-2026:26610
AlmaLinux:8	xorg-x11-server-Xnest	1.20.11-28.el8_10.2	ALSA-2026:26709
AlmaLinux:9	xorg-x11-server-Xnest	1.20.11-34.el9_8.2	ALSA-2026:26610
AlmaLinux:8	xorg-x11-server-Xorg	1.20.11-28.el8_10.2	ALSA-2026:26709
AlmaLinux:9	xorg-x11-server-Xorg	1.20.11-34.el9_8.2	ALSA-2026:26610
AlmaLinux:8	xorg-x11-server-Xvfb	1.20.11-28.el8_10.2	ALSA-2026:26709
AlmaLinux:9	xorg-x11-server-Xvfb	1.20.11-34.el9_8.2	ALSA-2026:26610
AlmaLinux:10	xorg-x11-server-Xwayland	24.1.9-4.el10_2.2	ALSA-2026:26566
AlmaLinux:8	xorg-x11-server-Xwayland	21.1.3-20.el8_10.2	ALSA-2026:26562
AlmaLinux:9	xorg-x11-server-Xwayland	24.1.9-4.el9_8.2	ALSA-2026:26590
AlmaLinux:10	xorg-x11-server-Xwayland-devel	24.1.9-4.el10_2.2	ALSA-2026:26566
AlmaLinux:9	xorg-x11-server-Xwayland-devel	24.1.9-4.el9_8.2	ALSA-2026:26590
AlmaLinux:8	xorg-x11-server-common	1.20.11-28.el8_10.2	ALSA-2026:26709
AlmaLinux:9	xorg-x11-server-common	1.20.11-34.el9_8.2	ALSA-2026:26610
AlmaLinux:8	xorg-x11-server-devel	1.20.11-28.el8_10.2	ALSA-2026:26709
AlmaLinux:9	xorg-x11-server-devel	1.20.11-34.el9_8.2	ALSA-2026:26610
AlmaLinux:8	xorg-x11-server-source	1.20.11-28.el8_10.2	ALSA-2026:26709
AlmaLinux:9	xorg-x11-server-source	1.20.11-34.el9_8.2	ALSA-2026:26610
Debian:12	xorg-server	2:21.1.7-3+deb12u13	DEBIAN-CVE-2026-50258
Debian:13	xorg-server	2:21.1.16-1.3+deb13u3	DEBIAN-CVE-2026-50258
Debian:14	xorg-server	2:21.1.23-1	DEBIAN-CVE-2026-50258
Debian:12	xwayland	no fix listed	DEBIAN-CVE-2026-50258
Debian:13	xwayland	no fix listed	DEBIAN-CVE-2026-50258
Debian:14	xwayland	2:24.1.12-1	DEBIAN-CVE-2026-50258
Rocky Linux:8	tigervnc	0:1.15.0-10.el8_10	RLSA-2026:28923
Rocky Linux:9	tigervnc	0:1.15.0-7.el9_8.2	RLSA-2026:29844
Rocky Linux:8	xorg-x11-server	0:1.20.11-28.el8_10.2	RLSA-2026:26709
Rocky Linux:9	xorg-x11-server	0:1.20.11-34.el9_8.2	RLSA-2026:26610
Rocky Linux:10	xorg-x11-server-Xwayland	0:24.1.9-4.el10_2.2	RLSA-2026:26566
Rocky Linux:8	xorg-x11-server-Xwayland	0:21.1.3-20.el8_10.2	RLSA-2026:26562
Rocky Linux:9	xorg-x11-server-Xwayland	0:24.1.9-4.el9_8.2	RLSA-2026:26590
Ubuntu:22.04:LTS	xorg-server	no fix listed	UBUNTU-CVE-2026-50258
Ubuntu:24.04:LTS	xorg-server	no fix listed	UBUNTU-CVE-2026-50258
Ubuntu:25.10	xorg-server	no fix listed	UBUNTU-CVE-2026-50258
Ubuntu:26.04:LTS	xorg-server	no fix listed	UBUNTU-CVE-2026-50258
Ubuntu:26.10	xorg-server	no fix listed	UBUNTU-CVE-2026-50258
Ubuntu:22.04:LTS	xwayland	no fix listed	UBUNTU-CVE-2026-50258
Ubuntu:24.04:LTS	xwayland	no fix listed	UBUNTU-CVE-2026-50258
Ubuntu:25.10	xwayland	no fix listed	UBUNTU-CVE-2026-50258
Ubuntu:26.04:LTS	xwayland	no fix listed	UBUNTU-CVE-2026-50258
Ubuntu:26.10	xwayland	no fix listed	UBUNTU-CVE-2026-50258

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat Enterprise Linux 10	see references
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION	see references
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	see references
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	see references
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	see references
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	see references
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	see references
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	see references
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	see references
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	see references
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	see references
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	see references
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	see references

Weakness: CWE-121 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

RHSA-2026:26562 vendor-advisory, x_refsource_REDHAT
RHSA-2026:26566 vendor-advisory, x_refsource_REDHAT
RHSA-2026:26590 vendor-advisory, x_refsource_REDHAT
RHSA-2026:26610 vendor-advisory, x_refsource_REDHAT
RHSA-2026:26709 vendor-advisory, x_refsource_REDHAT
RHSA-2026:28923 vendor-advisory, x_refsource_REDHAT
RHSA-2026:29844 vendor-advisory, x_refsource_REDHAT
RHSA-2026:36083 vendor-advisory, x_refsource_REDHAT
RHSA-2026:36085 vendor-advisory, x_refsource_REDHAT
RHSA-2026:36086 vendor-advisory, x_refsource_REDHAT
RHSA-2026:36087 vendor-advisory, x_refsource_REDHAT
RHSA-2026:36632 vendor-advisory, x_refsource_REDHAT
RHSA-2026:36633 vendor-advisory, x_refsource_REDHAT
RHSA-2026:36634 vendor-advisory, x_refsource_REDHAT
RHSA-2026:36768 vendor-advisory, x_refsource_REDHAT
RHSA-2026:36791 vendor-advisory, x_refsource_REDHAT
RHSA-2026:36792 vendor-advisory, x_refsource_REDHAT
RHSA-2026:36798 vendor-advisory, x_refsource_REDHAT
RHSA-2026:38502 vendor-advisory, x_refsource_REDHAT
RHSA-2026:38810 vendor-advisory, x_refsource_REDHAT
RHSA-2026:46377 vendor-advisory, x_refsource_REDHAT
RHSA-2026:46382 vendor-advisory, x_refsource_REDHAT
RHSA-2026:46385 vendor-advisory, x_refsource_REDHAT
RHSA-2026:46392 vendor-advisory, x_refsource_REDHAT
RHSA-2026:46456 vendor-advisory, x_refsource_REDHAT
RHSA-2026:46460 vendor-advisory, x_refsource_REDHAT
RHSA-2026:46473 vendor-advisory, x_refsource_REDHAT
RHSA-2026:49519 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-50258 vdb-entry, x_refsource_REDHAT
RHBZ#2485383 issue-tracking, x_refsource_REDHAT
https://gitlab.freedesktop.org/xorg/xserver/-/commit/543e108516428fc8c3bea91d6563ad266f9a801e
https://lists.x.org/archives/xorg-announce/2026-June/003702.html
https://redhat.atlassian.net/browse/PSIRTSUPT-16950
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50258.json x_sadp-csaf-vex