Loading vulnerability…
Stack buffer overflow in X.Org and Xwayland font alias resolution
CVE-2026-50256 is a stack-based buffer overflow affecting X.Org X server versions before 21.1.23 and Xwayland versions before 24.1.12. During font alias resolution, the X server uses a 256-byte stack buffer while libXfont2 permits alias target names up to 1,024 bytes. Alias names between 257 and 1,023 bytes are copied into the undersized buffer without length validation through memcpy in doListFontsAndAliases() and memmove in doListFontsWithInfo(). The resulting stack corruption can crash the server and potentially enable privilege escalation when the server runs as root.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation can corrupt adjacent stack memory, including local variables and return addresses, and cause an X server crash. Successful exploitation against an X server running as root may escalate a local attacker's privileges to root. Root compromise is conditional on the server's execution privileges and successful exploitation of the memory corruption.
If you can’t patch tonight, do this now.
No temporary workaround is specified. Apply the fixed upstream releases or vendor security updates.
Patch, then assume compromise.
Upgrade to X.Org Server 21.1.23 or later, Xwayland 24.1.12 or later, or distribution packages containing the backported fix. For Debian stable (trixie), upgrade xorg-server packages to 2:21.1.16-1.3+deb13u3 or later. EulerOS and Rocky Linux installations should apply their corresponding vendor security updates. The upstream fix increases XLFDMAXFONTNAMELEN from 256 to 1024 and adds explicit bounds checks before copying resolved font names, rejecting oversized names with BadFontName.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
34 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.